CVE Feed

    Dashboard / CVE / CVE-2009-1553

    CVE-2009-1553

    Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.

    Published:May 6, 2009
    Last Modified:Apr 23, 2026
    EPS:May 6, 2009
    EPSS Score:0.0183
    CVSS Score:4.3

    Affected Products

    Vendor
    Oracle
    Product
    Glassfish Server

    Exploits

    http://dsecrg.com/pages/vul/show.php?id=134http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlhttp://www.securityfocus.com/bid/34824http://dsecrg.com/pages/vul/show.php?id=134http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlhttp://www.securityfocus.com/bid/34824https://www.exploit-db.com/exploits/32980https://www.exploit-db.com/exploits/32971https://www.exploit-db.com/exploits/32974https://www.exploit-db.com/exploits/32975https://www.exploit-db.com/exploits/32977https://www.exploit-db.com/exploits/32978https://www.exploit-db.com/exploits/32979https://www.exploit-db.com/exploits/32981

    Related CVEs

    CVE-2021-3314 (CVSS 6.1) — Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can ca…
    CVE-2018-2911 (CVSS 8.3) — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server …
    CVE-2018-3152 (CVSS 7.5) — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administrati…
    CVE-2018-3210 (CVSS 5.3) — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server …
    CVE-2018-14324 (CVSS 9.8) — The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password…
    CVE-2017-10393 (CVSS 6.3) — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Containe…
    CVE-2017-10391 (CVSS 7.3) — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administrati…
    CVE-2017-10385 (CVSS 6.3) — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Containe…
    CVE-2017-10400 (CVSS 5.4) — Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administrati…
    CVE-2017-1000028 (CVSS 7.5) — Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Direc…

    References

    http://dsecrg.com/pages/vul/show.php?id=134
    http://jvn.jp/en/jp/JVN73653977/index.html
    http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html
    http://osvdb.org/54249
    http://osvdb.org/54250
    http://osvdb.org/54251
    http://osvdb.org/54252
    http://osvdb.org/54253
    http://osvdb.org/54254
    http://osvdb.org/54255
    http://osvdb.org/54256
    http://osvdb.org/54257
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1
    http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html
    http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
    http://www.securityfocus.com/archive/1/503236/100/0/threaded
    http://www.securityfocus.com/bid/34824
    http://www.securityfocus.com/bid/34914
    http://www.vupen.com/english/advisories/2009/1255
    https://exchange.xforce.ibmcloud.com/vulnerabilities/50453
    https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668
    https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669
    https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675
    http://dsecrg.com/pages/vul/show.php?id=134
    http://jvn.jp/en/jp/JVN73653977/index.html
    http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html
    http://osvdb.org/54249
    http://osvdb.org/54250
    http://osvdb.org/54251
    http://osvdb.org/54252
    http://osvdb.org/54253
    http://osvdb.org/54254
    http://osvdb.org/54255
    http://osvdb.org/54256
    http://osvdb.org/54257
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-258528-1
    http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html
    http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
    http://www.securityfocus.com/archive/1/503236/100/0/threaded
    http://www.securityfocus.com/bid/34824
    http://www.securityfocus.com/bid/34914
    http://www.vupen.com/english/advisories/2009/1255
    https://exchange.xforce.ibmcloud.com/vulnerabilities/50453
    https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29668
    https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29669
    https://glassfish.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=29675

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High