PT-2009-4245 · Ulteo · Ulteo Open Virtual Desktop

Published 2009-05-22 · Updated 2024-02-14 · CVE-2009-1775

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Ulteo Open Virtual Desktop version 1.0

Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via several API endpoints, including "admin/applications.php", "admin/appsgroup.php", "admin/users.php", "admin/usersgroup.php", and "admin/tasks.php" by manipulating the id parameter, "admin/logs.php" by manipulating the show parameter, and "admin/configuration-partial.php" by manipulating the mode parameter.

Recommendations: For Ulteo Open Virtual Desktop version 1.0, consider restricting access to the vulnerable API endpoints, such as "admin/applications.php", "admin/appsgroup.php", "admin/users.php", "admin/usersgroup.php", "admin/tasks.php", "admin/logs.php", and "admin/configuration-partial.php", until a patch is available. As a temporary workaround, avoid using the id, show, and mode parameters in the respective affected endpoints to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-1775

Affected Products

Ulteo Open Virtual Desktop

References · 5

• http://secunia.com/advisories/34923 · Vendor Advisory
• http://ulteo.com/home/en/ovdi/openvirtualdesktop/downloadnow?autolang=en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1775 · Security Note
• http://insight-tech.org/index.php?p=Ulteo-Open-Virtual-Desktop-v1-0-multiple-XSS · Note
• http://securityfocus.com/bid/34927 · Note