{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-06-11T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the login interface (my.logon.php3) in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "35418", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/35418"}, {"name": "35426", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/35426"}, {"tags": ["x_refsource_MISC"], "url": "https://www.fox-it.com/nl/nieuws-en-events/nieuws/laatste-nieuws/nieuwsartikel/f5-firepass-cross-site-scripting-vulnerability/106"}, {"name": "55040", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/55040"}, {"tags": ["x_refsource_MISC"], "url": "https://www.fox-it.com/uploads/pdf/advisory_xss_f5_firepass.pdf"}, {"name": "20090611 F5 FirePass Cross-Site Scripting vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/504232/100/0/threaded"}, {"name": "35312", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/35312"}, {"name": "firepasssslvpn-unspecified-xss(51064)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51064"}, {"name": "ADV-2009-1570", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/1570"}, {"name": "1022387", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1022387"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-2119", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in the login interface (my.logon.php3) in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "35418", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/35418"}, {"name": "35426", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/35426"}, {"name": "https://www.fox-it.com/nl/nieuws-en-events/nieuws/laatste-nieuws/nieuwsartikel/f5-firepass-cross-site-scripting-vulnerability/106", "refsource": "MISC", "url": "https://www.fox-it.com/nl/nieuws-en-events/nieuws/laatste-nieuws/nieuwsartikel/f5-firepass-cross-site-scripting-vulnerability/106"}, {"name": "55040", "refsource": "OSVDB", "url": "http://osvdb.org/55040"}, {"name": "https://www.fox-it.com/uploads/pdf/advisory_xss_f5_firepass.pdf", "refsource": "MISC", "url": "https://www.fox-it.com/uploads/pdf/advisory_xss_f5_firepass.pdf"}, {"name": "20090611 F5 FirePass Cross-Site Scripting vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/504232/100/0/threaded"}, {"name": "35312", "refsource": "BID", "url": "http://www.securityfocus.com/bid/35312"}, {"name": "firepasssslvpn-unspecified-xss(51064)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51064"}, {"name": "ADV-2009-1570", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/1570"}, {"name": "1022387", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1022387"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-2119", "datePublished": "2009-06-18T21:00:00", "dateReserved": "2009-06-18T00:00:00", "dateUpdated": "2018-10-10T18:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:5.5:*:*:*:*:*:*:*", "matchCriteriaId": "7C2AE5BB-5D4B-4CA3-BB28-2BE9A4974CE2", "vulnerable": true}, {"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:5.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "B7ABAF45-EB5E-44C9-AF4D-EDF741BABCE5", "vulnerable": true}, {"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:5.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "4976941E-BDAA-4AD2-AB70-7B4A2E134246", "vulnerable": true}, {"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "01AFA837-B856-482A-8192-5E92FD40EA65", "vulnerable": true}, {"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:6.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "D7AA0609-9A3B-4C83-8DE6-2589152F8CF6", "vulnerable": true}, {"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:6.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "7093053B-97DB-4B45-9E36-5A52A28CDCE1", "vulnerable": true}, {"criteria": "cpe:2.3:h:f5:firepass_ssl_vpn:6.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "8BA897F6-03C3-4182-B288-6F9C1337C10E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the login interface (my.logon.php3) in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos cruzados(XSS) en el interface de autenticaci\u00f3n de F5 FirePass SSL VPN v5.5 hasta v5.5.2 y 6.0 hasta v6.0.3 , permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de un campo password manipulado. NOTA: algunos de estos detalles se han obtenido de terceros."}], "id": "CVE-2009-2119", "lastModified": "2018-10-10T19:39:18.647", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2009-06-18T21:30:00.407", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/55040"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/35418"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/35426"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/504232/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/35312"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.securitytracker.com/id?1022387"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2009/1570"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51064"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.fox-it.com/nl/nieuws-en-events/nieuws/laatste-nieuws/nieuwsartikel/f5-firepass-cross-site-scripting-vulnerability/106"}, {"source": "cve@mitre.org", "url": "https://www.fox-it.com/uploads/pdf/advisory_xss_f5_firepass.pdf"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}