CVE-2009-3748 - CVE House

Back to Database

Status published Medium CVE-2009-3748

Multiple cross-site scripting (XSS) vulnerabilities in the Web Administrator in...

4.3 CVSS

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in the Web Administrator in Websense Personal Email Manager 7.1 before Hotfix 4 and Email Security 7.1 before Hotfix 4 allow remote attackers to inject arbitrary web script or HTML via the (1) FileName, (2) IsolatedMessageID, (3) ServerName, (4) Dictionary, (5) Scoring, and (6) MessagePart parameters to web/msgList/viewmsg/actions/msgAnalyse.asp; the (7) Queue, (8) FileName, (9) IsolatedMessageID, and (10) ServerName parameters to actions/msgForwardToRiskFilter.asp and viewHeaders.asp in web/msgList/viewmsg/; and (11) the subject in an e-mail message that is held in a Queue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-3748

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from websense

View All →

TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict...

Stack-based buffer overflow in the handle_debug_network function in the manager...

SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers...

SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers...

The Mail Server in Websense TRITON AP-EMAIL and V-Series appliances...

Affected Vendor

websense

View all reports →

Affected Software

personal email manager, websense email security

Vulnerable Versions:

7.1

Timeline

Official Publish: October 22nd, 2009

Last Modified: August 7th, 2024

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.