CVE-2009-1553

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-05-06 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.

Affected products

Oracle Corporation GlassFish Server: 2.1

References

http://dsecrg.com/pages/vul/show.php?id=134
http://jvn.jp/en/jp/JVN73653977/index.html
http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000027.html
http://osvdb.org/54249
http://osvdb.org/54250
http://osvdb.org/54251
http://osvdb.org/54252
http://osvdb.org/54253
http://osvdb.org/54254
http://osvdb.org/54255
http://osvdb.org/54256
http://osvdb.org/54257

Get alerted when CVE-2009-1553 or the next vulnerability affects your stack