CVE-2009-2898: springsource application_management_suite Cross-site Scripting
Vulnerability summary
CVE-2009-2898 is a low (CVSS 3.5) Cross-site Scripting vulnerability in springsource application_management_suite. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.5% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 13-10-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.83%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.83% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (corelabs.coresecurity.com)
Maturity: unknown
Hyperic HQ 3.2 < 4.2-beta1 - Multiple Cross-Site Scripting Vulnerabilities
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Springsource3 products
- application_management_suite2.0.0:sr3
- hyperic_hq3.2:beta_1 | 3.2.0 | 3.2.1 | 3.2.2 | 3.2.3 | 3.2.4 | 3.2.5 | 3.2.6 | 4.0.0 | 4.0.1 | 4.0.2 | 4.0.3 | 4.1.0 | 4.1.1 | 4.1.2 | 4.2:beta_1
- tc_server6.0.20:b
1 vendor · 3 products
References
9 links- jira.hyperic.com/browse/HHQ-3390X Refsource CONFIRM