CVE-2009-0307: rim blackberry_enterprise_server Cross-site Scripting
Vulnerability summary
CVE-2009-0307 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in rim blackberry_enterprise_server. EPSS estimates a 3.49% chance of exploitation in the next 30 days, higher than 89% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 22-04-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in the "Customize Statistics Page" (admin/statistics/ConfigureStatistics) in the MDS Connection Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) before 4.1.6 MR5 allows remote attackers to inject arbitrary web script or HTML via the (1) customDate, (2) interval, (3) lastCustomInterval, (4) lastIntervalLength, (5) nextCustomInterval, (6) nextIntervalLength, (7) action, (8) delIntervalIndex, (9) addStatIndex, (10) delStatIndex, and (11) referenceTime parameters.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.49%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.49% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (securityfocus.com)
Maturity: unknown
BlackBerry Enterprise Server 4.0/4.1 - MDS Connection Service Cross-Site Scripting
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Rim1 product
- blackberry_enterprise_server≤ 4.1.6 | 4.0 | 4.0:sp3 | 4.0.3 | 4.1 | 4.1:sp3 | 4.1.3 | 4.1.4 | 4.1.5 | 4.1.6
1 vendor · 1 product