CVE-2009-2898 - CVE House
Back to Database
Status published Low CVE-2009-2898

Cross-site scripting (XSS) vulnerability in the Alerts list feature in...

Vulnerability Description

Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-2898

Credits & Attribution

No credits recorded in the NVD database.

References

More from springsource

View All →
CVE-2014-0054
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8...
Medium 6.8
CVE-2013-7315
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1...
Medium 6.8
CVE-2013-4152
The Spring OXM wrapper in Spring Framework before 3.2.4 and...
Medium 6.8
CVE-2012-1833
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does...
Medium 5
CVE-2011-2730
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before...
High 7.5

Affected Vendor

springsource

View all reports →

Affected Software

application management suite, hyperic hq, tc server
Vulnerable Versions:
2.0.0, 3.2, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.1.0, 4.1.1, 4.1.2, 4.2, 6.0.20

Timeline

Official Publish: October 13th, 2009
Last Modified: August 7th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.