{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Best Practical Solutions RT 3.6.x before 3.6.9, 3.8.x before 3.8.5, and other 3.4.6 through 3.8.4 versions allows remote attackers to inject arbitrary web script or HTML via certain Custom Fields."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2009-11-17T18:00:00Z"}, "references": [{"name": "[oss-security] 20091116 Re: CVE Id request: request-tracker", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/11/16/4"}, {"name": "[rt-announce] 20090914 RT 3.8.5 Released", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000173.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546778"}, {"name": "[rt-announce] 20090914 RT 3.6.9 Released", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000172.html"}, {"name": "[oss-security] 20091115 CVE Id request: request-tracker", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/11/15/1"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T06:45:50.610Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20091116 Re: CVE Id request: request-tracker", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/11/16/4"}, {"name": "[rt-announce] 20090914 RT 3.8.5 Released", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000173.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546778"}, {"name": "[rt-announce] 20090914 RT 3.6.9 Released", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000172.html"}, {"name": "[oss-security] 20091115 CVE Id request: request-tracker", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/11/15/1"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2009-3892", "state": "PUBLISHED", "dateReserved": "2009-11-05T00:00:00Z", "datePublished": "2009-11-17T18:00:00Z", "dateUpdated": "2024-08-07T06:45:50.610Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bestpractical:rt:3.4.6:*:*:*:*:*:*:*", "matchCriteriaId": "F98B7895-BDB3-477C-8B34-88BD3E02EAFF", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "1512169D-DCEF-4964-B05A-3DF19CDE8F57", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "B427F5D4-ACD6-46E5-B94F-CA30330C6492", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "E9B38C33-D680-4285-A849-E6CDA9F4802F", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "646CFD82-15FE-48E4-83C9-E3E037E9F928", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.6.4:*:*:*:*:*:*:*", "matchCriteriaId": "57404A14-6E1C-4F3B-8120-75F1073A3E18", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.6.5:*:*:*:*:*:*:*", "matchCriteriaId": "3F40ED56-CDAC-40BB-A026-5D6A09DCB72C", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.6.6:*:*:*:*:*:*:*", "matchCriteriaId": "33C325D9-CB88-430F-B1AE-3544C7176398", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.6.7:*:*:*:*:*:*:*", "matchCriteriaId": "F1E86D15-8435-46B9-88FF-8A51771C55E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.6.8:*:*:*:*:*:*:*", "matchCriteriaId": "543C8E63-9A49-4D6A-899A-7D244D0CCC17", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C503726A-4AAB-4444-A204-7F53A6369919", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "F2B93F59-E22F-47E0-A5EA-D5716E9EAB48", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*", "matchCriteriaId": "0BF01543-2929-4ADA-BD74-ABE00BF066BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*", "matchCriteriaId": "562E9782-259B-42C6-BC3E-C452799A78FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*", "matchCriteriaId": "C4D2E2C8-15E8-45E4-9DBF-6CF2BEB30576", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Best Practical Solutions RT 3.6.x before 3.6.9, 3.8.x before 3.8.5, and other 3.4.6 through 3.8.4 versions allows remote attackers to inject arbitrary web script or HTML via certain Custom Fields."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Best Practical Solutions RT v3.6.x anteriores a v3.6.9, v3.8.x anteriores a v3.8.5, y otros desde v3.4.6 hasta v3.8.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de ciertos campos personalizados."}], "id": "CVE-2009-3892", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2009-11-17T18:30:00.407", "references": [{"source": "secalert@redhat.com", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546778"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000172.html"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000173.html"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2009/11/15/1"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2009/11/16/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546778"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000172.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://lists.bestpractical.com/pipermail/rt-announce/2009-September/000173.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2009/11/15/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2009/11/16/4"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "Request Tracker XSS flaw", "id": "538173", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=538173"}, "csaw": false, "cwe": "CWE-79", "details": ["Cross-site scripting (XSS) vulnerability in Best Practical Solutions RT 3.6.x before 3.6.9, 3.8.x before 3.8.5, and other 3.4.6 through 3.8.4 versions allows remote attackers to inject arbitrary web script or HTML via certain Custom Fields."], "name": "CVE-2009-3892", "public_date": "2009-11-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2009-3892"], "threat_severity": "Moderate"}