CVEvulnerability
CVE-2009-4473
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-12-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in WorkArea/ContentDesigner/ekformsiframe.aspx in Ektron CMS400.NET 7.6.1.53 and 7.6.6.47, and possibly 7.52 through 7.66sp2, allow remote attackers to inject arbitrary web script or HTML via the (1) css, (2) eca, (3) id, and (4) skin parameters. NOTE: some of these details are obtained from third party information.
Affected configurations
• ektron cms4000.net 7.6.0
• ektron cms4000.net 7.6.1
• ektron cms4000.net 7.6.1.53
• ektron cms4000.net 7.6.5
• ektron cms4000.net 7.6.6
• ektron cms4000.net 7.6.6.47
• ektron cms4000.net 7.52
• ektron cms4000.net 7.53
• ektron cms4000.net 7.54
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://dev.ektron.com/forum.aspx?g=posts&t=28048 Patch, Vendor Advisory
- http://dev.ektron.com/notices.aspx?id=19074 dev.ektron.com
- http://osvdb.org/57667 osvdb.org
- http://secunia.com/advisories/36591 Vendor Advisory
- http://www.securityfocus.com/bid/36279 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53043 exchange.xforce.ibmcloud.com
- http://dev.ektron.com/forum.aspx?g=posts&t=28048 Patch, Vendor Advisory
- http://dev.ektron.com/notices.aspx?id=19074 dev.ektron.com
- http://osvdb.org/57667 osvdb.org
- http://secunia.com/advisories/36591 Vendor Advisory
- http://www.securityfocus.com/bid/36279 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53043 exchange.xforce.ibmcloud.com