CVE-2009-3730
Multiple cross-site scripting (XSS) vulnerabilities in the ReqWeb Help feature (aka the Web Client Help system) in IBM Rational RequisitePro 7.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the operation parameter to…
Does this matter?
Lower severity and a low EPSS score (3.45%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the ReqWeb Help feature (aka the Web Client Help system) in IBM Rational RequisitePro 7.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the operation parameter to ReqWebHelp/advanced/workingSet.jsp, or the (2) searchWord, (3) maxHits, (4) scopedSearch, or (5) scope parameter to ReqWebHelp/basic/searchView.jsp.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 3.45% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ibm/rational requisitepro
- Source
- cve@mitre.org
References
- http://osvdb.org/59088
- http://osvdb.org/59089
- http://secunia.com/advisories/37052Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK83895Exploit, Patch, Vendor Advisory
- http://www.securityfocus.com/bid/36721Exploit
- http://www.vupen.com/english/advisories/2009/2958Patch, Vendor Advisory
- http://osvdb.org/59088
- http://osvdb.org/59089
- http://secunia.com/advisories/37052Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK83895Exploit, Patch, Vendor Advisory
- http://www.securityfocus.com/bid/36721Exploit
- http://www.vupen.com/english/advisories/2009/2958Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.