CVE-2009-0307

Cross-site scripting (XSS) vulnerability in the "Customize Statistics Page" (admin/statistics/ConfigureStatistics) in the MDS Connection Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) before 4.1.6 MR5 allows remote attackers to inject arbitrary web script or HTML via the (1) customDate, (2) interval, (3) lastCustomInterval, (4) lastIntervalLength, (5) nextCustomInterval, (6) nextIntervalLength, (7) action, (8) delIntervalIndex, (9) addStatIndex, (10) delStatIndex, and (11) referenceTime parameters.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:rim:blackberry_enterprise_server:*:mr4:*:*:*:*:*:*
cpe:2.3:a:rim:blackberry_enterprise_server:4.0:*:*:*:*:*:*:*
cpe:2.3:a:rim:blackberry_enterprise_server:4.0:sp3:*:*:*:*:*:*
cpe:2.3:a:rim:blackberry_enterprise_server:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:rim:blackberry_enterprise_server:4.1:*:*:*:*:*:*:*
cpe:2.3:a:rim:blackberry_enterprise_server:4.1:sp3:*:*:*:*:*:*
cpe:2.3:a:rim:blackberry_enterprise_server:4.1.3:*:*:*:*:*:*:*
cpe:2.3:a:rim:blackberry_enterprise_server:4.1.4:*:*:*:*:*:*:*
cpe:2.3:a:rim:blackberry_enterprise_server:4.1.5:*:*:*:*:*:*:*
cpe:2.3:a:rim:blackberry_enterprise_server:4.1.6:*:*:*:*:*:*:*

History

21 Nov 2024, 00:59

Type Values Removed Values Added
References () http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0170.html - () http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0170.html -
References () http://osvdb.org/53772 - () http://osvdb.org/53772 -
References () http://secunia.com/advisories/34740 - Vendor Advisory () http://secunia.com/advisories/34740 - Vendor Advisory
References () http://www.blackberry.com/btsc/dynamickc.do?externalId=KB17969&sliceID=1&command=show&forward=nonthreadedKC&kcId=KB17969 - Vendor Advisory () http://www.blackberry.com/btsc/dynamickc.do?externalId=KB17969&sliceID=1&command=show&forward=nonthreadedKC&kcId=KB17969 - Vendor Advisory
References () http://www.securityfocus.com/bid/34573 - Exploit () http://www.securityfocus.com/bid/34573 - Exploit
References () http://www.securitytracker.com/id?1022081 - () http://www.securitytracker.com/id?1022081 -
References () http://www.vupen.com/english/advisories/2009/1090 - () http://www.vupen.com/english/advisories/2009/1090 -

Information

Published : 2009-04-22 18:30

Updated : 2024-11-21 00:59


NVD link : CVE-2009-0307

Mitre link : CVE-2009-0307

CVE.ORG link : CVE-2009-0307


JSON object : View

Products Affected

rim

  • blackberry_enterprise_server
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')