CVE-2009-0307

Cross-site scripting (XSS) vulnerability in the "Customize Statistics Page" (admin/statistics/ConfigureStatistics) in the MDS Connection Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) before 4.1.6 MR5 allows remote attackers to inject arbitrary web script or HTML via the (1) customDate, (2) interval, (3) lastCustomInterval, (4) lastIntervalLength, (5) nextCustomInterval, (6) nextIntervalLength, (7) action, (8) delIntervalIndex, (9) addStatIndex, (10) delStatIndex, and (11) referenceTime parameters.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

3.49% chance of exploitation in the next 30 days, 88th percentile

Published

2009-04-22

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/32927

References

• CVE Record
• NVD entry

Related

• CVE-2009-0304
• CVE-2009-0321
• CVE-2009-0302
• CVE-2009-0323
• CVE-2009-0301
• CVE-2009-0324