CVE-2009-1553: oracle glassfish_server Cross-site Scripting

CVSS: 4.3v2.0MediumModified

AliasesUBUNTU-CVE-2009-1553

Published 06-05-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-1553 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in oracle glassfish_server. EPSS estimates a 8.20% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities. 11 public exploits are recorded.

Overall risk

29/100

0100

Medium · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

8.20%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits11reference, exploit-database

Timeline

06-05-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

8.20%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 8.20% on 21-09-2026

21-09-202621-10-2026

EPSS score

8.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

11 found

referenceUnverified
Exploit Reference (nabble.com)
Maturity: unknown
referenceUnverified
Exploit Reference (dsecrg.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown

Show all 11 exploits

exploit-databaseremotemultipleVerified
GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting
Maturity: weaponized
exploit-databaseremotemultipleVerified
GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting
Maturity: weaponized
exploit-databaseremotemultipleVerified
GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting
Maturity: weaponized
exploit-databaseremotemultipleVerified
GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting
Maturity: weaponized
exploit-databaseremotemultipleVerified
GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting
Maturity: weaponized
exploit-databaseremotemultipleVerified
GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting
Maturity: weaponized
exploit-databaseremotemultipleVerified
GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting
Maturity: weaponized
exploit-databaseremotemultipleVerified
GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Oracle1 product

glassfish_server2.1

Ubuntu1 product

glassfishAll versions (No fix recorded)

2 vendors · 2 products

References

25 links

www.securityfocus.com/archive/1/503236/100/0/threadedMailing ListX Refsource BUGTRAQ
sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1Vendor AdvisoryX Refsource SUNALERT
www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlMailing ListX Refsource MLISTExploit
osvdb.org/54254VDB EntryX Refsource OSVDB
glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675Mailing ListX Refsource MLISTPatchVendor Advisory
osvdb.org/54256VDB EntryX Refsource OSVDB
www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.htmlMailing ListX Refsource MLIST
osvdb.org/54250VDB EntryX Refsource OSVDB
osvdb.org/54253VDB EntryX Refsource OSVDB
osvdb.org/54257VDB EntryX Refsource OSVDB

Show all 25 references

glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669Mailing ListX Refsource MLISTPatchVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/50453VDB EntryX Refsource XF
jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.htmlThird Party AdvisoryX Refsource JVNDB
www.vupen.com/english/advisories/2009/1255VDB EntryX Refsource VUPEN
glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668Mailing ListX Refsource MLISTPatchVendor Advisory
osvdb.org/54252VDB EntryX Refsource OSVDB
osvdb.org/54255VDB EntryX Refsource OSVDB
dsecrg.com/pages/vul/show.php?id=134X Refsource MISCExploit
osvdb.org/54249VDB EntryX Refsource OSVDB
jvn.jp/en/jp/JVN73653977/index.htmlThird Party AdvisoryX Refsource JVN
osvdb.org/54251VDB EntryX Refsource OSVDB
www.securityfocus.com/bid/34824VDB EntryX Refsource BIDExploit
www.securityfocus.com/bid/34914VDB EntryX Refsource BID
ubuntu.com/security/CVE-2009-1553REPORT
www.cve.org/CVERecord?id=CVE-2009-1553REPORT

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities