VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 6, 2009· Updated Jun 16, 2026

CVE-2009-3300

CVE-2009-3300

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

Affected products

17
  • Internet2/Identity Provider9 versions
    cpe:2.3:a:internet2:identity_provider:1.3:*:*:*:*:*:*:*+ 8 more
    • cpe:2.3:a:internet2:identity_provider:1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:identity_provider:1.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:identity_provider:1.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:identity_provider:1.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:identity_provider:2.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:identity_provider:2.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:identity_provider:2.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:identity_provider:2.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:identity_provider:2.1.4:*:*:*:*:*:*:*
  • Internet2/Service Provider7 versions
    cpe:2.3:a:internet2:service_provider:1.3:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:internet2:service_provider:1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:service_provider:1.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:service_provider:1.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:service_provider:1.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:service_provider:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:service_provider:2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:internet2:service_provider:2.2:*:*:*:*:*:*:*
  • Internet2/Shibboleth Spllm-fuzzy
    Range: Identity Provider 1.3 < 1.3.4 and 2.x < 2.1.5; Service Provider 1.3 < 1.3.5 and 2.x < 2.3

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.