CVEvulnerability
CVE-2009-0417
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-02-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the AgaviWebRouting::gen(null) method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not strictly follow RFC 3986, such as Internet Explorer 6 and 7.
Affected configurations
• agavi agavi 0.11.0
• agavi agavi 0.11.1
• agavi agavi 0.11.2
• agavi agavi 0.11.3
• agavi agavi 0.11.4
• agavi agavi 0.11.5
• agavi agavi 0.11.6
• agavi agavi 1.0.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://blog.agavi.org/post/75829956/agavi-0-11-6-released-fixes-vulnerability Patch, Vendor Advisory
- http://blog.agavi.org/post/75830918/agavi-1-0-0-beta-8-released-fixes-vulnerability Patch, Vendor Advisory
- http://trac.agavi.org/ticket/1019 Vendor Advisory
- http://www.securityfocus.com/bid/33826 www.securityfocus.com
- http://blog.agavi.org/post/75829956/agavi-0-11-6-released-fixes-vulnerability Patch, Vendor Advisory
- http://blog.agavi.org/post/75830918/agavi-1-0-0-beta-8-released-fixes-vulnerability Patch, Vendor Advisory
- http://trac.agavi.org/ticket/1019 Vendor Advisory
- http://www.securityfocus.com/bid/33826 www.securityfocus.com