Skip to content
Back to search

CVE-2009-3731

MEDIUM
4.3NVD

Summary

generated automatically from NVD data

WebWorks Help 2.0 through 5.0, as bundled in VMware products such as vCenter, ESX 4.0, Server 2.0.2, Lab Manager and Stage Manager, and in WebWorks Publisher and ePublisher, contains multiple cross-site scripting (CWE-79) flaws. Remote attackers can inject arbitrary web script or HTML through files such as wwhelp_entry.html, api.htm, frameset.htm, switch.js and bookmark.htm, via unspecified parameters and bookmarking topic-link messages. The issue carries a CVSS v2.0 score of 4.3 (MEDIUM).

NVD description

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

Share:

EPSS · FIRST.org

2.8%probability of exploitation in the next 30 days

Higher than 86% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.

CVSS v2.0 Score

4.3
/ 10.0
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N

Information

Published
16 déc. 2009
Updated
16 juin 2026
Status
Modified
Source
cve@mitre.org

Affected products

webworks epublisher
Versions : 9.0, 9.1, 9.2, 9.3, 2008.1
webworks help
Versions : 2.0, 3.0, 4.0, 5.0
webworks publisher
Versions : 6.0, 7.0, 8.0, 2003
vmware vcenter
Versions : 4.0
vmware esx server
Versions : 4.0
vmware lab manager
Versions : 2.0
vmware server
Versions : 2.0.2
vmware stage manager
Versions : 4.0, 1.0

Weaknesses (CWE)

CWE-79

References (28)

Similar CVEs

Other vulnerabilities of type CWE-79

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring