Cross-Site Scripting Vulnerabilities in Sun Java System Communications Express
CVE-2009-1729

Currently unrated

Key Information:

Vendor
Oracle
Status
Java System Communications Express
Vendor
CVE Published:
21 May 2009

Summary

Multiple cross-site scripting (XSS) vulnerabilities exist in Sun Java System Communications Express versions 6.2 and 6.3, allowing remote attackers to inject arbitrary web scripts or HTML. These vulnerabilities arise from improper handling of user input in the Add Contact functionality of the Personal Address Book component, particularly through the 'abperson_displayName' parameter, and also via the 'temporaryCalendars' parameter within the UWCMain interface. Exploiting these vulnerabilities can lead to unauthorized actions on behalf of users, compromising the system's integrity and exposing sensitive information.

References

http://www.securityfocus.com/bid/34155
vdb-entryx_refsource_BID
http://osvdb.org/54609
vdb-entryx_refsource_OSVDB
http://www.vupen.com/english/advisories/2009/1389
vdb-entryx_refsource_VUPEN

EPSS Score

8% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.