CVE-2009-4185

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-02-05 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in proxy/smhui/getuiinfo in HP System Management Homepage (SMH) before 6.0 allows remote attackers to inject arbitrary web script or HTML via the servercert parameter.

Affected products

Hewlett Packard Enterprise System Management Homepage for Windows and Linux: through 3.0.2.77; 2.0.0, 2.0.1, 2.0.2, 2.1, 2.1.0-103, 2.1.0-103(a) (+30)

References

http://marc.info/?l=bugtraq&m=126529736830358&w=2
http://secunia.com/advisories/38341
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-15
http://www.securityfocus.com/archive/1/509195/100/0/threaded
http://www.securityfocus.com/bid/38081
http://www.securitytracker.com/id?1023541
http://www.vupen.com/english/advisories/2010/0294
http://marc.info/?l=bugtraq&m=126529736830358&w=2
http://secunia.com/advisories/38341
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-15
http://www.securityfocus.com/archive/1/509195/100/0/threaded
http://www.securityfocus.com/bid/38081

Get alerted when CVE-2009-4185 or the next vulnerability affects your stack