CVE-2009-0237
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."
Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en cookieauth.dll en el componente HTML forms authentication en Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); e Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, y 2006 SP1; permite a atacantes remotos inyectar código web script o HTML de su elección a través de "entrada de autenticación" a este componente, también conocido como "Vulnerabilidad de secuencias de comandos en sitios cruzados".
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-01-20 CVE Reserved
- 2009-04-15 CVE Published
- 2024-08-07 CVE Updated
- 2024-08-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/53637 | Vdb Entry | |
| http://secunia.com/advisories/34687 | Third Party Advisory | |
| http://www.securitytracker.com/id?1022046 | Vdb Entry | |
| http://www.us-cert.gov/cas/techalerts/TA09-104A.html | Third Party Advisory | |
| http://www.vupen.com/english/advisories/2009/1030 | Vdb Entry | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5771 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-016 | 2018-10-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Forefront Threat Management Gateway Search vendor "Microsoft" for product "Forefront Threat Management Gateway" | - | medium_business |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Internet Security And Acceleration Server Search vendor "Microsoft" for product "Internet Security And Acceleration Server" | 2004 Search vendor "Microsoft" for product "Internet Security And Acceleration Server" and version "2004" | sp3, enterprise |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Internet Security And Acceleration Server Search vendor "Microsoft" for product "Internet Security And Acceleration Server" | 2004 Search vendor "Microsoft" for product "Internet Security And Acceleration Server" and version "2004" | sp3, standard |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Internet Security And Acceleration Server Search vendor "Microsoft" for product "Internet Security And Acceleration Server" | 2006 Search vendor "Microsoft" for product "Internet Security And Acceleration Server" and version "2006" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Internet Security And Acceleration Server Search vendor "Microsoft" for product "Internet Security And Acceleration Server" | 2006 Search vendor "Microsoft" for product "Internet Security And Acceleration Server" and version "2006" | supportability |
Affected
| ||||||