CVEvulnerability
CVE-2009-3029
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2009-10-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the console in Symantec SecurityExpressions Audit and Compliance Server 4.1.1, 4.1, and earlier allows remote authenticated users to inject arbitrary web script or HTML via "external client input" that triggers crafted error messages.
Affected configurations
• symantec securityexpressions audit and compliance server (<= 4.1.1)
• symantec securityexpressions audit and compliance server 4.1
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://secunia.com/advisories/36972 Vendor Advisory
- http://securitytracker.com/id?1022989 securitytracker.com
- http://www.osvdb.org/58651 www.osvdb.org
- http://www.securityfocus.com/bid/36570 Patch
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091006_00 www.symantec.com
- http://www.vupen.com/english/advisories/2009/2849 Vendor Advisory
- http://secunia.com/advisories/36972 Vendor Advisory
- http://securitytracker.com/id?1022989 securitytracker.com
- http://www.osvdb.org/58651 www.osvdb.org
- http://www.securityfocus.com/bid/36570 Patch
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091006_00 www.symantec.com
- http://www.vupen.com/english/advisories/2009/2849 Vendor Advisory