CVE-2009-3731 : Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

Published 2009-12-16 18:30:00

Updated 2018-10-10 19:47:30

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2009-3731

Vmware » Esx Server » Version: 4.0
cpe:2.3:a:vmware:esx_server:4.0:*:*:*:*:*:*:*
Matching versions
Vmware » Server » Version: 2.0.2
cpe:2.3:a:vmware:server:2.0.2:*:*:*:*:*:*:*
Matching versions
Vmware » Vcenter » Version: 4.0
cpe:2.3:a:vmware:vcenter:4.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Vmware » Lab Manager » Version: 2.0
cpe:2.3:a:vmware:lab_manager:2.0:*:*:*:*:*:*:*
Matching versions
Vmware » Vcenter Lab Manager » Version: 3.0
cpe:2.3:a:vmware:vcenter_lab_manager:3.0:*:*:*:*:*:*:*
Matching versions
Vmware » Vcenter Lab Manager » Version: 3.0.1
cpe:2.3:a:vmware:vcenter_lab_manager:3.0.1:*:*:*:*:*:*:*
Matching versions
Vmware » Vcenter Lab Manager » Version: 3.0.2
cpe:2.3:a:vmware:vcenter_lab_manager:3.0.2:*:*:*:*:*:*:*
Matching versions
Vmware » Vcenter Lab Manager » Version: 4.0
cpe:2.3:a:vmware:vcenter_lab_manager:4.0:*:*:*:*:*:*:*
Matching versions
Vmware » Stage Manager
Versions up to, including, (<=) 4.0
cpe:2.3:a:vmware:stage_manager:*:*:*:*:*:*:*:*
Matching versions
Vmware » Stage Manager » Version: 1.0
cpe:2.3:a:vmware:stage_manager:1.0:*:*:*:*:*:*:*
Matching versions
Vmware » Vcenter Stage Manager » Version: 1.0.1
cpe:2.3:a:vmware:vcenter_stage_manager:1.0.1:*:*:*:*:*:*:*
Matching versions
Webworks » Epublisher » Version: 2009.2
cpe:2.3:a:webworks:epublisher:2009.2:*:*:*:*:*:*:*
Matching versions
Webworks » Epublisher » Version: 2009.1
cpe:2.3:a:webworks:epublisher:2009.1:*:*:*:*:*:*:*
Matching versions
Webworks » Epublisher » Version: 9.1
cpe:2.3:a:webworks:epublisher:9.1:*:*:*:*:*:*:*
Matching versions
Webworks » Epublisher » Version: 9.0
cpe:2.3:a:webworks:epublisher:9.0:*:*:*:*:*:*:*
Matching versions
Webworks » Epublisher » Version: 2008.4
cpe:2.3:a:webworks:epublisher:2008.4:*:*:*:*:*:*:*
Matching versions
Webworks » Epublisher » Version: 2008.3
cpe:2.3:a:webworks:epublisher:2008.3:*:*:*:*:*:*:*
Matching versions
Webworks » Epublisher » Version: 2008.2
cpe:2.3:a:webworks:epublisher:2008.2:*:*:*:*:*:*:*
Matching versions
Webworks » Epublisher » Version: 2008.1
cpe:2.3:a:webworks:epublisher:2008.1:*:*:*:*:*:*:*
Matching versions
Webworks » Epublisher » Version: 9.3
cpe:2.3:a:webworks:epublisher:9.3:*:*:*:*:*:*:*
Matching versions
Webworks » Epublisher » Version: 9.2
cpe:2.3:a:webworks:epublisher:9.2:*:*:*:*:*:*:*
Matching versions
Webworks » Help » Version: 2.0
cpe:2.3:a:webworks:help:2.0:*:*:*:*:*:*:*
Matching versions
Webworks » Help » Version: 3.0
cpe:2.3:a:webworks:help:3.0:*:*:*:*:*:*:*
Matching versions
Webworks » Help » Version: 4.0
cpe:2.3:a:webworks:help:4.0:*:*:*:*:*:*:*
Matching versions
Webworks » Help » Version: 5.0
cpe:2.3:a:webworks:help:5.0:*:*:*:*:*:*:*
Matching versions
Webworks » Publisher » Version: 7.0
cpe:2.3:a:webworks:publisher:7.0:*:*:*:*:*:*:*
Matching versions
Webworks » Publisher » Version: 8.0
cpe:2.3:a:webworks:publisher:8.0:*:*:*:*:*:*:*
Matching versions
Webworks » Publisher » Version: 2003
cpe:2.3:a:webworks:publisher:2003:*:*:*:*:*:*:*
Matching versions
Webworks » Publisher » Version: 6.0
cpe:2.3:a:webworks:publisher:6.0:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2009-3731

Top countries where our scanners detected CVE-2009-3731

Top open port discovered on systems with this issue 80

IPs affected by CVE-2009-3731 13

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2009-3731!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2009-3731

EPSS FAQ

0.33%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 67 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-3731

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2009-3731

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-3731