Vulnerability CVE-2009-1218

Vulnerability Name:

CVE-2009-1218 (CCN-49561)

Assigned:

2009-03-31

Published:

2009-03-31

Updated:

2018-10-10

Summary:

Multiple cross-site scripting (XSS) vulnerabilities in Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allow remote attackers to inject arbitrary web script or HTML via (1) the fmt-out parameter to login.wcap or (2) the date parameter to command.shtml.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Access Complexity (AC): Authentication (Au):
Impact Metrics:	Confidentiality (C): Integrity (I): Availibility (A):

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Access Complexity (AC): Athentication (Au):
Impact Metrics:	Confidentiality (C): Integrity (I): Availibility (A):

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-1218

Source: CCN
Type: SA34528
Sun Java System Calendar Server Multiple Vulnerabilities

Source: CCN
Type: Sun Alert ID: 256228
Cross-Site Scripting (XSS) Vulnerability in Sun Java System Calendar Server

Source: SUNALERT
Type: Patch, Vendor Advisory
256228

Source: SUNALERT
Type: UNKNOWN
1020321

Source: CCN
Type: ASA-2009-141
Cross-Site Scripting (XSS) Vulnerability in Sun Java System Calendar Server (Sun 256228)

Source: CCN
Type: CORE-2009-0108
Multiple vulnerabilities in Sun Calendar Express Web Server

Source: MISC
Type: Exploit
http://www.coresecurity.com/content/sun-calendar-express

Source: BUGTRAQ
Type: UNKNOWN
20090331 CORE-2009-0108: Multiple vulnerabilities in Sun Calendar Express Web Server

Source: BID
Type: UNKNOWN
34152

Source: CCN
Type: BID-34152
Sun Java System Calendar Server 'login.wcap' Cross Site Scripting Vulnerability

Source: BID
Type: UNKNOWN
34153

Source: CCN
Type: BID-34153
Sun Java System Calendar Server 'command.shtml' Cross Site Scripting Vulnerability

Source: VUPEN
Type: UNKNOWN
ADV-2009-0905

Source: XF
Type: UNKNOWN
systemcalendarserver-login-xss(49561)

Vulnerable Configuration:

Configuration 1:

cpe:/a:sun:java_system_calendar_server:6:-:sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_calendar_server:6.3:-:sparc:*:*:*:*:*

OR cpe:/a:sun:one_calendar_server:6.0:-:sparc:*:*:*:*:*

Configuration 2:

cpe:/a:sun:java_system_calendar_server:6:-:x86:*:*:*:*:*

OR cpe:/a:sun:java_system_calendar_server:6.3:-:x86:*:*:*:*:*

OR cpe:/a:sun:one_calendar_server:6.0:-:x86:*:*:*:*:*

Configuration 3:

cpe:/a:sun:java_system_calendar_server:6:-:linux:*:*:*:*:*

OR cpe:/a:sun:java_system_calendar_server:6.3:-:linux:*:*:*:*:*

OR cpe:/a:sun:one_calendar_server:6.0:-:linux:*:*:*:*:*

Configuration CCN 1:

cpe:/a:sun:one_calendar_server:6.0:*:*:*:*:*:*:*

OR cpe:/a:sun:java_system_calendar_server:6.3:*:*:*:*:*:*:*

OR cpe:/a:sun:java_system_calendar_server:6:2005q4:*:*:*:*:*:*

OR cpe:/a:sun:java_system_calendar_server:6:2005q1:*:*:*:*:*:*

AND

cpe:/o:sun:solaris:*:*:x86:*:*:*:*:*

OR cpe:/o:sun:solaris:*:*:sparc:*:*:*:*:*

Denotes that component is vulnerable

Vulnerability Name:

CVE-2009-1218 (CCN-49563)

Assigned:

2009-03-31

Published:

2009-03-31

Updated:

2018-10-10

Summary:

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Access Complexity (AC): Authentication (Au):
Impact Metrics:	Confidentiality (C): Integrity (I): Availibility (A):

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Access Complexity (AC): Athentication (Au):
Impact Metrics:	Confidentiality (C): Integrity (I): Availibility (A):

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-1218

Source: CCN
Type: SA34528
Sun Java System Calendar Server Multiple Vulnerabilities

Source: CCN
Type: Sun Alert ID: 256228
Cross-Site Scripting (XSS) Vulnerability in Sun Java System Calendar Server

Source: CCN
Type: ASA-2009-141
Cross-Site Scripting (XSS) Vulnerability in Sun Java System Calendar Server (Sun 256228)

Source: CCN
Type: CORE-2009-0108
Multiple vulnerabilities in Sun Calendar Express Web Server

Source: CCN
Type: BID-34152
Sun Java System Calendar Server 'login.wcap' Cross Site Scripting Vulnerability

Source: CCN
Type: BID-34153
Sun Java System Calendar Server 'command.shtml' Cross Site Scripting Vulnerability

Source: XF
Type: UNKNOWN
systemcalendarserver-command-xss(49563)

BACK