CVE-2009-4416 - Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw_" sequence

Back Back to CVE browser

MEDIUM

Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw_" sequence

Published Dec 24, 2009

4.3

MEDIUM

CVSS 2.0

EPSS 2.27%

Description

Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw_" sequence.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (9)

http://kambing.ui.ac.id/gentoo-portage/www-apps/phpgroupware/files/phpgroupware-SA35519.patch
x_refsource_MISCPatch
http://secunia.com/advisories/35519
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/login.php?r1=19063&r2=19117&pathrev=19117&sortby=date&root=phpgroupware
x_refsource_CONFIRM
http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware
x_refsource_CONFIRM
http://svn.savannah.gnu.org/viewvc?view=rev&root=phpgroupware&sortby=date&revision=19117
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2009/12/20/1
mailing-listx_refsource_MLIST
http://www.osvdb.org/56179
vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/35761
vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilities/51923
vdb-entryx_refsource_XF

Link	Providers	Tags
http://kambing.ui.ac.id/gentoo-portage/www-apps/phpgroupware/files/phpgroupware-SA35519.patch		x_refsource_MISCPatch
http://secunia.com/advisories/35519		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/login.php?r1=19063&r2=19117&pathrev=19117&sortby=date&root=phpgroupware		x_refsource_CONFIRM
http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware		x_refsource_CONFIRM
http://svn.savannah.gnu.org/viewvc?view=rev&root=phpgroupware&sortby=date&revision=19117		x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2009/12/20/1		mailing-listx_refsource_MLIST
http://www.osvdb.org/56179		vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/35761		vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilities/51923		vdb-entryx_refsource_XF

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 24, 2009

Updated Aug 7, 2024

Reserved Dec 24, 2009

Link CVE-2009-4416

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2009-4416

Red Hat

Severity n/a

Public date n/a

Links CVE-2009-4416