{"schemaVersion":3,"id":"CVE-2009-1553","aliases":["UBUNTU-CVE-2009-1553"],"status":"published","duplicateOf":null,"title":null,"description":"Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.","dates":{"published":"2009-05-06T16:00:00.000Z","modified":"2024-08-07T05:20:33.751Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.08199,"percentile":0.94859,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.08199},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.08199,"percentile":0.94859}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.08199,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.08199,"percentile":0.94859}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_6913B81162C01BCB","name":"Exploit Reference (nabble.com)","source":"reference","url":"http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_192B3417DDFB7C92","name":"Exploit Reference (dsecrg.com)","source":"reference","url":"http://dsecrg.com/pages/vul/show.php?id=134","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_3E81733914737B75","name":"Exploit Reference (securityfocus.com)","source":"reference","url":"http://www.securityfocus.com/bid/34824","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"32980","name":"GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting","source":"exploit-database","url":"https://www.exploit-db.com/exploits/32980","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/32980.txt","codes":["CVE-2009-1553","OSVDB-54255"]},"metasploit":null},{"id":"32981","name":"GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting","source":"exploit-database","url":"https://www.exploit-db.com/exploits/32981","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/32981.txt","codes":["CVE-2009-1553","OSVDB-54257"]},"metasploit":null},{"id":"32971","name":"GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting","source":"exploit-database","url":"https://www.exploit-db.com/exploits/32971","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/32971.txt","codes":["CVE-2009-1553","OSVDB-54249"]},"metasploit":null},{"id":"32974","name":"GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting","source":"exploit-database","url":"https://www.exploit-db.com/exploits/32974","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/32974.txt","codes":["CVE-2009-1553","OSVDB-54250"]},"metasploit":null},{"id":"32975","name":"GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting","source":"exploit-database","url":"https://www.exploit-db.com/exploits/32975","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/32975.txt","codes":["CVE-2009-1553","OSVDB-54251"]},"metasploit":null},{"id":"32977","name":"GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting","source":"exploit-database","url":"https://www.exploit-db.com/exploits/32977","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/32977.txt","codes":["CVE-2009-1553","OSVDB-54252"]},"metasploit":null},{"id":"32978","name":"GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting","source":"exploit-database","url":"https://www.exploit-db.com/exploits/32978","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/32978.txt","codes":["CVE-2009-1553","OSVDB-54253"]},"metasploit":null},{"id":"32979","name":"GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting","source":"exploit-database","url":"https://www.exploit-db.com/exploits/32979","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/32979.txt","codes":["CVE-2009-1553","OSVDB-54254"]},"metasploit":null}],"exploitCount":11,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"ubuntu","product":"glassfish","name":"glassfish","label":"glassfish","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/glassfish","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"oracle","product":"glassfish_server","name":"glassfish server","label":"glassfish_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.1","eol":null,"hubHref":"/vendor/oracle/glassfish_server"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/archive/1/503236/100/0/threaded","label":"www.securityfocus.com/archive/1/503236/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT"]},{"url":"http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html","label":"www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html","hostname":"www.nabble.com","tags":["Mailing List","X Refsource MLIST","Exploit"]},{"url":"http://osvdb.org/54254","label":"osvdb.org/54254","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675","label":"glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675","hostname":"glassfish.dev.java.net","tags":["Mailing List","X Refsource MLIST","Patch","Vendor Advisory"]},{"url":"http://osvdb.org/54256","label":"osvdb.org/54256","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html","label":"www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html","hostname":"www.nabble.com","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://osvdb.org/54250","label":"osvdb.org/54250","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://osvdb.org/54253","label":"osvdb.org/54253","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://osvdb.org/54257","label":"osvdb.org/54257","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669","label":"glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669","hostname":"glassfish.dev.java.net","tags":["Mailing List","X Refsource MLIST","Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50453","label":"exchange.xforce.ibmcloud.com/vulnerabilities/50453","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html","label":"jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html","hostname":"jvndb.jvn.jp","tags":["Third Party Advisory","X Refsource JVNDB"]},{"url":"http://www.vupen.com/english/advisories/2009/1255","label":"www.vupen.com/english/advisories/2009/1255","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668","label":"glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668","hostname":"glassfish.dev.java.net","tags":["Mailing List","X Refsource MLIST","Patch","Vendor Advisory"]},{"url":"http://osvdb.org/54252","label":"osvdb.org/54252","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://osvdb.org/54255","label":"osvdb.org/54255","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://dsecrg.com/pages/vul/show.php?id=134","label":"dsecrg.com/pages/vul/show.php?id=134","hostname":"dsecrg.com","tags":["X Refsource MISC","Exploit"]},{"url":"http://osvdb.org/54249","label":"osvdb.org/54249","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://jvn.jp/en/jp/JVN73653977/index.html","label":"jvn.jp/en/jp/JVN73653977/index.html","hostname":"jvn.jp","tags":["Third Party Advisory","X Refsource JVN"]},{"url":"http://osvdb.org/54251","label":"osvdb.org/54251","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://www.securityfocus.com/bid/34824","label":"www.securityfocus.com/bid/34824","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Exploit"]},{"url":"http://www.securityfocus.com/bid/34914","label":"www.securityfocus.com/bid/34914","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"https://ubuntu.com/security/CVE-2009-1553","label":"ubuntu.com/security/CVE-2009-1553","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1553","label":"www.cve.org/CVERecord?id=CVE-2009-1553","hostname":"www.cve.org","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2009-05-06T16:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T05:20:33.751Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":29,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T02:20:39.479Z","stale":false,"partial":false}}