CVE-2009-4459
- Source
- https://cve.org/CVERecord?id=CVE-2009-4459
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2009-4459.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2009-4459
- Downstream
- Published
- 2009-12-30T20:00:01Z
- Modified
- 2026-04-10T03:41:01.689139Z
- Summary
- [none]
- Details
-
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.
- References