PT-2009-6351 · Sun · Sun Java System Portal Server

Published 2009-12-03 · Updated 2009-12-04 · CVE-2009-4187

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Portal Server versions 6.3.1, 7.1, 7.2

Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which can lead to multiple cross-site scripting (XSS) vulnerabilities in the Gateway component.

Recommendations For Sun Java System Portal Server version 6.3.1, update to a version that includes the fix for this issue. For Sun Java System Portal Server version 7.1, update to a version that includes the fix for this issue. For Sun Java System Portal Server version 7.2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Gateway component until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4187

Affected Products

Sun Java System Portal Server

References · 5

• http://sunsolve.sun.com/search/document.do?assetkey=1-66-269368-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4187 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-138686-04-1 · Patch
• http://securityfocus.com/bid/37186 · Note
• http://securitytracker.com/id?1023260 · Note