NetSight
IP …
medium4.3

CVE-2009-3731

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; V…

Impact

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

Affected products

VendorProductAffected versions
WebworksEpublisher
Versions 9.0, 9.1, 9.2, 9.3, 2008.1, 2008.2
WebworksHelp
Versions 2.0, 3.0, 4.0, 5.0
WebworksPublisher
Versions 6.0, 7.0, 8.0, 2003
VmwareVcenter
Version 4.0
VmwareEsx Server
Version 4.0
VmwareLab Manager
Version 2.0
VmwareServer
Version 2.0.2
VmwareStage Manager
through 4.0
Version 1.0
VmwareVcenter Lab Manager
Versions 3.0, 3.0.1, 3.0.2, 4.0
VmwareVcenter Stage Manager
Version 1.0.1

Weakness classification

CWE-79

References