PT-2009-2919 · 53Kf · 53Kf Web Im

Published 2009-01-22 · Updated 2018-10-11 · CVE-2009-0247

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions 53KF Web IM 2009 versions Home, Professional, and Enterprise editions

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks by sending a crafted IM message. This is related to the msg variable.

Recommendations For 53KF Web IM 2009 Home edition, update the client-side protection mechanisms to prevent cross-site scripting attacks. For 53KF Web IM 2009 Professional edition, restrict the use of the msg variable to minimize the risk of exploitation. For 53KF Web IM 2009 Enterprise edition, consider implementing additional server-side validation to prevent crafted IM messages.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-0247

Affected Products

53Kf Web Im

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-0247 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48096 · Note
• http://securityfocus.com/bid/33341 · Note
• http://securityfocus.com/archive/1/500169/100/0/threaded · Note