VulnerabilityModified
CVE-2009-3029
Cross-site scripting (XSS) vulnerability in the console in Symantec SecurityExpressions Audit and Compliance Server 4.1.1, 4.1, and earlier allows remote authenticated users to inject arbitrary web script or HTML via "external client input" that…
LOW 3.5EPSS 1.05%
Does this matter?
Lower severity and a low EPSS score (1.05%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in the console in Symantec SecurityExpressions Audit and Compliance Server 4.1.1, 4.1, and earlier allows remote authenticated users to inject arbitrary web script or HTML via "external client input" that triggers crafted error messages.
- CVSS 2.0
- 3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
- EPSS
- 1.05% probability · 62th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- symantec/securityexpressions audit and compliance server
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/36972Vendor Advisory
- http://securitytracker.com/id?1022989
- http://www.osvdb.org/58651
- http://www.securityfocus.com/bid/36570Patch
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091006_00
- http://www.vupen.com/english/advisories/2009/2849Vendor Advisory
- http://secunia.com/advisories/36972Vendor Advisory
- http://securitytracker.com/id?1022989
- http://www.osvdb.org/58651
- http://www.securityfocus.com/bid/36570Patch
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091006_00
- http://www.vupen.com/english/advisories/2009/2849Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.