PT-2009-5256 · Springsource · Springsource Hyperic Hq+2
Published
2009-10-13
·
Updated
2018-10-10
·
CVE-2009-2898
CVSS v2.0
3.5
Low
| Vector | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
SpringSource Hyperic HQ versions 3.2.x through 3.2.6.0
SpringSource Hyperic HQ versions 4.0.x through 4.0.3.0
SpringSource Hyperic HQ versions 4.1.x through 4.1.2.0
SpringSource Hyperic HQ version 4.2-beta1
Application Management Suite (AMS) version 2.0.0.SR3
tc Server version 6.0.20.B
Description:
The issue is related to a cross-site scripting (XSS) vulnerability in the Alerts list feature of the web interface. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the
Description field.Recommendations:
For SpringSource Hyperic HQ versions 3.2.x through 3.2.6.0, update to version 3.2.6.1 or later.
For SpringSource Hyperic HQ versions 4.0.x through 4.0.3.0, update to version 4.0.3.1 or later.
For SpringSource Hyperic HQ versions 4.1.x through 4.1.2.0, update to version 4.1.2.1 or later.
For SpringSource Hyperic HQ version 4.2-beta1, update to a newer version that includes the fix.
For Application Management Suite (AMS) version 2.0.0.SR3, update to a newer version that includes the fix.
For tc Server version 6.0.20.B, update to a newer version that includes the fix.
As a temporary workaround, consider restricting access to the Alerts list feature in the web interface until a patch is available.
Avoid using the
Description field in the Alerts list feature until the issue is resolved.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Application Management Suite
Springsource Hyperic Hq
Tc Server