Details of VAR-200904-0461

ID

VAR-200904-0461

CVE

CVE-2009-1287

TITLE

Cisco SESM Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2009-003337

DESCRIPTION

Cross-site scripting (XSS) vulnerability in Cisco Subscriber Edge Services Manager (SESM) allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: some of these details are obtained from third party information. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. We don't know which versions of Subscriber Edge Services Manager are affected. We will update this BID as more information emerges

Trust: 1.98

sources: NVD: CVE-2009-1287 // JVNDB: JVNDB-2009-003337 // BID: 34454 // VULHUB: VHN-38733

AFFECTED PRODUCTS

vendor:	cisco	model:	subscriber edge services manager	scope:	-	version:	-	Trust: 1.4
vendor:	cisco	model:	subscriber edge services manager	scope:	eq	version:	*	Trust: 1.0
vendor:	cisco	model:	subscriber edge services manager	scope:	eq	version:	0	Trust: 0.3

sources: BID: 34454 // JVNDB: JVNDB-2009-003337 // CNNVD: CNNVD-200904-262 // NVD: CVE-2009-1287

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2009-1287
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2009-1287
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-200904-262
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-38733
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2009-1287
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-38733
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-38733 // JVNDB: JVNDB-2009-003337 // CNNVD: CNNVD-200904-262 // NVD: CVE-2009-1287

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-38733 // JVNDB: JVNDB-2009-003337 // NVD: CVE-2009-1287

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200904-262

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-200904-262

CONFIGURATIONS

sources: JVNDB: JVNDB-2009-003337

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-38733

PATCH

title:

Top Page

url:

http://www.cisco.com/en/US/products/sw/netmgtsw/ps4889/index.html

Trust: 0.8

sources: JVNDB: JVNDB-2009-003337

EXTERNAL IDS

db:	NVD	id:	CVE-2009-1287	Trust: 2.5
db:	BID	id:	34454	Trust: 2.0
db:	SECTRACK	id:	1022030	Trust: 1.7
db:	JVNDB	id:	JVNDB-2009-003337	Trust: 0.8
db:	XF	id:	50349	Trust: 0.6
db:	CNNVD	id:	CNNVD-200904-262	Trust: 0.6
db:	EXPLOIT-DB	id:	32897	Trust: 0.1
db:	SEEBUG	id:	SSVID-86163	Trust: 0.1
db:	VULHUB	id:	VHN-38733	Trust: 0.1

sources: VULHUB: VHN-38733 // BID: 34454 // JVNDB: JVNDB-2009-003337 // CNNVD: CNNVD-200904-262 // NVD: CVE-2009-1287

REFERENCES

url:	http://www.xc0re.net/index.php?p=1_17_cisco-subscriber-edge-services-manager-multiple-vulnerabilities	Trust: 2.0
url:	http://www.securityfocus.com/bid/34454	Trust: 1.7
url:	http://securitytracker.com/id?1022030	Trust: 1.7
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/50349	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-1287	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-1287	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/50349	Trust: 0.6
url:	http://www.cisco.com/en/us/products/sw/netmgtsw/ps4889/index.html	Trust: 0.3

sources: VULHUB: VHN-38733 // BID: 34454 // JVNDB: JVNDB-2009-003337 // CNNVD: CNNVD-200904-262 // NVD: CVE-2009-1287

CREDITS

Usman Saeed, Xc0re Security Research Group

Trust: 0.9

sources: BID: 34454 // CNNVD: CNNVD-200904-262

SOURCES

db:	VULHUB	id:	VHN-38733
db:	BID	id:	34454
db:	JVNDB	id:	JVNDB-2009-003337
db:	CNNVD	id:	CNNVD-200904-262
db:	NVD	id:	CVE-2009-1287

LAST UPDATE DATE

2025-04-10T23:13:57.305000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-38733	date:	2017-08-17T00:00:00
db:	BID	id:	34454	date:	2009-05-06T20:06:00
db:	JVNDB	id:	JVNDB-2009-003337	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-200904-262	date:	2009-05-13T00:00:00
db:	NVD	id:	CVE-2009-1287	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-38733	date:	2009-04-13T00:00:00
db:	BID	id:	34454	date:	2009-04-09T00:00:00
db:	JVNDB	id:	JVNDB-2009-003337	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-200904-262	date:	2009-04-13T00:00:00
db:	NVD	id:	CVE-2009-1287	date:	2009-04-13T16:30:00.420