Unrated severityNVD Advisory· Published Feb 10, 2009· Updated Apr 23, 2026
CVE-2009-0417
CVE-2009-0417
Description
Cross-site scripting (XSS) vulnerability in the AgaviWebRouting::gen(null) method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not strictly follow RFC 3986, such as Internet Explorer 6 and 7.
Affected products
32cpe:2.3:a:agavi:agavi:0.11.0:*:*:*:*:*:*:*+ 31 more
- cpe:2.3:a:agavi:agavi:0.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.0:rc5:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.0:rc6:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.0:rc7:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.1:rc3:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.2:rc2:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.3:rc2:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.4:*:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.5:*:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.6:*:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:0.11.6:rc2:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:1.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:1.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:1.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:1.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:1.0.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:1.0.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:agavi:agavi:1.0.0:beta7:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- blog.agavi.org/post/75829956/agavi-0-11-6-released-fixes-vulnerabilitynvdPatchVendor Advisory
- blog.agavi.org/post/75830918/agavi-1-0-0-beta-8-released-fixes-vulnerabilitynvdPatchVendor Advisory
- trac.agavi.org/ticket/1019nvdVendor Advisory
- www.securityfocus.com/bid/33826nvd
News mentions
0No linked articles in our index yet.