CVE-2009-4387

{"id": "CVE-2009-4387", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2009-12-22T23:30:00.517", "references": [{"url": "http://forums.manageengine.com/#Topic/49000003740390", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/37765", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.manageengine.com/products/passwordmanagerpro/release-notes.html", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.scip.ch/?vuldb.4063", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.scip.ch/publikationen/advisories/scip_advisory-4063_manageengine_pmp_script_injection.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/37336", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2009/3540", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for malicious inputs, which allows remote attackers to inject arbitrary web script or HTML via the searchtext parameter and other unspecified inputs."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en ShowInContentAreaAction.do en ManageEngine Password Manager Pro (PMP) en versi\u00f3nes anteriores a v6.1 Build 6104 utiliza comprobaci\u00f3n del uso de may\u00fasculas/min\u00fasculas para entradas maliciosas, lo que permite a atacantes remotos inyectar secuencias de comandos web o HTML de forma arbitraria a trav\u00e9s del par\u00e1metro \"searchtext\" y otras entradas sin especificar."}], "lastModified": "2009-12-23T05:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:manageengine:password_manager_pro:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F98F34C9-3D3B-4C67-88BF-8B4F8CD71832", "versionEndIncluding": "6.1"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro:*:-:standard:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A888EEC2-60E8-407C-ACE8-68AB5E882EBD", "versionEndIncluding": "6.1"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro:4.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B514D4E8-E996-4F8C-9830-3CB12B6FBE1C"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro:4.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFD9FC23-D877-44FA-8F86-4AF006A0C3E9"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro:4.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63DA6D0A-931D-4B07-86C1-06D4F36FA679"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAACBB2A-8F1E-4013-B3DA-1742CA66A944"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro:5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "076C49A5-C554-4820-AE83-5858209CF3C8"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro:5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E578FA0-E8AD-4BD5-B6B8-2357A2EAF4AC"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro:5.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EA9117D-2355-4FCE-876B-2E6FAED66A55"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro:5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27B0EF1B-B8C1-40E4-8545-F5B119FF50FD"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0783C5C-58CA-435E-B000-9787379DEB9D"}, {"criteria": "cpe:2.3:a:manageengine:password_manager_pro6.1:*:free:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D46C1E3-5B7F-466C-98BB-F910757F9A47", "versionEndIncluding": "-"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}