low3.5Public exploit code

CVE-2009-2898

Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1,…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Hyperic HQ 3.2 < 4.2-beta1 - Multiple Cross-Site Scripting Vulnerabilities2009-10-02 · webapps · jsp · Verified

Impact

Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information.

Affected products

Vendor	Product	Affected versions
Springsource	Application Management Suite	Version 2.0.0
Springsource	Hyperic Hq	Versions 3.2, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4
Springsource	Tc Server	Version 6.0.20

Weakness classification

CWE-79

Public exploit code

Impact

Affected products

Weakness classification

References