4.3 - CVE-2009-3731

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2009-3731	First vendor Publication	2009-12-16
Vendor	Cve	Last vendor Modification	2018-10-10

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score	4.3	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3731

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:5944

Oval ID:	oval:org.mitre.oval:def:5944
Title:	VMware vCenter, ESX patch and vCenter Lab Manager cross-site scripting issues
Description:	Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-3731	Version:	5
Platform(s):	VMWare ESX Server 4.0	Product(s):
Definition Synopsis:
VMware ESX Server 4.0 is installed AND Patch ESX400-200911223-UG is not installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Vmware Esx Server cpe:2.3:a:vmware:esx_server:4.0:::::::*	1
Application	Vmware Lab Manager cpe:2.3:a:vmware:lab_manager:2.0:::::::*	1
Application	Vmware Server cpe:2.3:a:vmware:server:2.0.2:::::::*	1
Application	Vmware Stage Manager cpe:2.3:a:vmware:stage_manager:1.0:::::::*	1
Application	Vmware Vcenter Lab Manager cpe:2.3:a:vmware:vcenter_lab_manager:4.0:::::::* cpe:2.3:a:vmware:vcenter_lab_manager:3.0.2:::::::* cpe:2.3:a:vmware:vcenter_lab_manager:3.0.1:::::::* cpe:2.3:a:vmware:vcenter_lab_manager:3.0:::::::*	4
Application	Vmware Vcenter Stage Manager cpe:2.3:a:vmware:vcenter_stage_manager:1.0.1:::::::*	1
Application	Webworks Epublisher cpe:2.3:a:webworks:epublisher:2009.2:::::::* cpe:2.3:a:webworks:epublisher:2009.1:::::::* cpe:2.3:a:webworks:epublisher:2008.4:::::::* cpe:2.3:a:webworks:epublisher:2008.3:::::::* cpe:2.3:a:webworks:epublisher:2008.2:::::::* cpe:2.3:a:webworks:epublisher:2008.1:::::::* cpe:2.3:a:webworks:epublisher:9.3:::::::* cpe:2.3:a:webworks:epublisher:9.2:::::::* cpe:2.3:a:webworks:epublisher:9.1:::::::* cpe:2.3:a:webworks:epublisher:9.0:::::::*	10
Application	Webworks Help cpe:2.3:a:webworks:help:5.0:::::::* cpe:2.3:a:webworks:help:4.0:::::::* cpe:2.3:a:webworks:help:3.0:::::::* cpe:2.3:a:webworks:help:2.0:::::::*	4
Application	Webworks Publisher cpe:2.3:a:webworks:publisher:2003:::::::* cpe:2.3:a:webworks:publisher:8.0:::::::* cpe:2.3:a:webworks:publisher:7.0:::::::* cpe:2.3:a:webworks:publisher:6.0:::::::*	4

OpenVAS Exploits

Date	Description
2009-12-21	Name : VMware Server Multiple Cross-Site Scripting Vulnerabilities (Linux) File : nvt/secpod_vmware_server_mult_xss_vuln_dec09_lin.nasl
2009-12-21	Name : VMware Server Multiple Cross-Site Scripting Vulnerabilities (Win) File : nvt/secpod_vmware_server_mult_xss_vuln_dec09_win.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
62742	CA SiteMinder WebWorks Help wwhelp/wwhimpl/common/html/bookmark.htm Unspecifi...
62741	CA SiteMinder WebWorks Help wwhelp/wwhimpl/common/scripts/switch.js Unspecifi...
62740	CA SiteMinder WebWorks Help wwhelp/wwhimpl/common/html/frameset.htm Unspecifi...
62739	CA SiteMinder WebWorks Help wwhelp/wwhimpl/api.htm Unspecified Parameter XSS
62738	CA SiteMinder WebWorks Help wwhelp_entry.html Unspecified Parameter XSS
61308	VMware vCenter Lab Manager WebWorks Help Page wwhelp/wwhimpl/common/html/book...
61307	VMware vCenter Lab Manager WebWorks Help Page wwhelp/wwhimpl/common/scripts/s...
61306	VMware vCenter Lab Manager WebWorks Help Page wwhelp/wwhimpl/common/html/fram...
61305	VMware vCenter Lab Manager WebWorks Help Page wwhelp/wwhimpl/api.htm XSS
61049	VMware vCenter Lab Manager WebWorks Help Page wwhelp_entry.html XSS

Nessus® Vulnerability Scanner

Date	Description
2016-03-03	Name : The remote host is missing a security-related patch. File : vmware_VMSA-2009-0017_remote.nasl - Type : ACT_GATHER_INFO
2014-11-26	Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2009-0017.nasl - Type : ACT_GATHER_INFO
2011-02-17	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2009-0017.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/37346
BUGTRAQ	http://archives.neohapsis.com/archives/bugtraq/2009-12/0229.html http://www.securityfocus.com/archive/1/509883/100/0/threaded
CONFIRM	http://www.webworks.com/Security/2009-0001/
MLIST	http://lists.vmware.com/pipermail/security-announce/2009/000073.html
OSVDB	http://www.osvdb.org/62738 http://www.osvdb.org/62739 http://www.osvdb.org/62740 http://www.osvdb.org/62741 http://www.osvdb.org/62742
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
SECTRACK	http://securitytracker.com/id?1023683
SECUNIA	http://secunia.com/advisories/38749 http://secunia.com/advisories/38842

Alert History

If you want to see full details history, please login or register.

Date	Informations
2021-05-04 12:10:22	Multiple Updates
2021-04-22 01:10:48	Multiple Updates
2020-05-23 01:41:00	Multiple Updates
2020-05-23 00:24:29	Multiple Updates
2018-10-11 00:19:42	Multiple Updates
2017-09-19 09:23:27	Multiple Updates
2016-06-28 17:52:26	Multiple Updates
2016-04-26 19:12:51	Multiple Updates
2016-03-04 13:26:25	Multiple Updates
2014-02-17 10:52:05	Multiple Updates
2013-05-10 23:59:50	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	1
CPE ID(s)	27
Sources(s)	14
osvdb(s)	10
Openvas Exploit(s)	2
Nessus® Exploit(s)	3

	Related
4.3	VMSA-2009-0017
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)