CVE-2009-3300

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2009-3300

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2009-3300.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2009-3300

Downstream

DEBIAN-CVE-2009-3300

DSA-1947-1

Published

2009-11-06T15:30:00Z

Modified

2025-08-09T19:01:29Z

Summary

[none]

Details

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

References

http://secunia.com/advisories/37237
http://shibboleth.internet2.edu/secadv/secadv_20091104.txt
http://www.debian.org/security/2009/dsa-1947
http://www.vupen.com/english/advisories/2009/3150
https://exchange.xforce.ibmcloud.com/vulnerabilities/54140

CVE-2009-3300

Affected packages