CVE-2009-5097

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-09-13 · updated 2026-06-16
Weakness: CWE-94

Description

Palm Pre WebOS 1.1 and earlier processes JavaScript in email messages, which allows remote attackers to execute arbitrary JavaScript, as demonstrated by reading PalmDatabase.db3.

Affected products

HP Palm Pre Webos: through 1.1.0; 1.0.2, 1.0.3, 1.0.4

References

http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#12
http://secunia.com/advisories/36936
http://tlhsecurity.blogspot.com/2009/10/palm-pre-webos-11-remote-file-access.html
http://www.precentral.net/webos-1-2-fixed-serious-file-security-issue
http://www.securitytracker.com/id?1022987
http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#12
http://secunia.com/advisories/36936
http://tlhsecurity.blogspot.com/2009/10/palm-pre-webos-11-remote-file-access.html
http://www.precentral.net/webos-1-2-fixed-serious-file-security-issue
http://www.securitytracker.com/id?1022987

Get alerted when CVE-2009-5097 or the next vulnerability affects your stack