{"api_version":"1","generated_at":"2026-07-23T04:57:26+00:00","cve":"CVE-2004-2435","urls":{"html":"https://cve.report/CVE-2004-2435","api":"https://cve.report/api/cve/CVE-2004-2435.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2004-2435","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2004-2435"},"summary":{"title":"CVE-2004-2435","description":"Cross-site scripting (XSS) vulnerability in PeopleSoft Human Resources Management System (HRMS) 7.0, when \"web enabled\" using HTML Access, allows remote attackers to inject arbitrary web script or HTML via unspecified (1) debugging or (2) utility scripts.","state":"PUBLISHED","assigner":"mitre","published_at":"2004-12-31 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17543","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17543","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.auscert.org.au/render.html?it=4419","name":"http://www.auscert.org.au/render.html?it=4419","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"AusCERT - AA-2004.003 -- PeopleSoft Human Resources Management System (HRMS) version 7 cross site scripting - UPDATED Oct 6 2004","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/11275","name":"http://www.securityfocus.com/bid/11275","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"PeopleSoft Human Resources Management System Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/12674/","name":"http://secunia.com/advisories/12674/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Secunia - Advisories - PeopleSoft HRMS Page Manipulation and Identity Spoofing","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/alerts/2004/Sep/1011433.html","name":"http://www.securitytracker.com/alerts/2004/Sep/1011433.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"SecurityTracker.com Archives - PeopleSoft Human Resources Management System (HRMS) Input Validation Holes Let Remote Users Conduct Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-2435","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-2435","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2004","cve_id":"2435","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"peoplesoft","cpe5":"hrms","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T01:29:12.923Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"AA-2004.03","tags":["third-party-advisory","x_refsource_AUSCERT","x_transferred"],"url":"http://www.auscert.org.au/render.html?it=4419"},{"name":"1011433","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/alerts/2004/Sep/1011433.html"},{"name":"11275","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/11275"},{"name":"peoplesoft-hrms-xss(17543)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17543"},{"name":"12674","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/12674/"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2004-09-29T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in PeopleSoft Human Resources Management System (HRMS) 7.0, when \"web enabled\" using HTML Access, allows remote attackers to inject arbitrary web script or HTML via unspecified (1) debugging or (2) utility scripts."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-10T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"AA-2004.03","tags":["third-party-advisory","x_refsource_AUSCERT"],"url":"http://www.auscert.org.au/render.html?it=4419"},{"name":"1011433","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/alerts/2004/Sep/1011433.html"},{"name":"11275","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/11275"},{"name":"peoplesoft-hrms-xss(17543)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17543"},{"name":"12674","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/12674/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2004-2435","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in PeopleSoft Human Resources Management System (HRMS) 7.0, when \"web enabled\" using HTML Access, allows remote attackers to inject arbitrary web script or HTML via unspecified (1) debugging or (2) utility scripts."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"AA-2004.03","refsource":"AUSCERT","url":"http://www.auscert.org.au/render.html?it=4419"},{"name":"1011433","refsource":"SECTRACK","url":"http://www.securitytracker.com/alerts/2004/Sep/1011433.html"},{"name":"11275","refsource":"BID","url":"http://www.securityfocus.com/bid/11275"},{"name":"peoplesoft-hrms-xss(17543)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17543"},{"name":"12674","refsource":"SECUNIA","url":"http://secunia.com/advisories/12674/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2004-2435","datePublished":"2005-08-20T04:00:00.000Z","dateReserved":"2005-08-20T00:00:00.000Z","dateUpdated":"2024-08-08T01:29:12.923Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2004-12-31 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:peoplesoft:hrms:7.0:*:*:*:*:*:*:*","matchCriteriaId":"10827693-6DF1-4CEA-BB8E-840E73428C8D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2004","CveId":"2435","Ordinal":"1","Title":"CVE-2004-2435","CVE":"CVE-2004-2435","Year":"2004"},"notes":[{"CveYear":"2004","CveId":"2435","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in PeopleSoft Human Resources Management System (HRMS) 7.0, when \"web enabled\" using HTML Access, allows remote attackers to inject arbitrary web script or HTML via unspecified (1) debugging or (2) utility scripts.","Type":"Description","Title":"CVE-2004-2435"},{"CveYear":"2004","CveId":"2435","Ordinal":"2","NoteData":"2005-08-20","Type":"Other","Title":"Published"},{"CveYear":"2004","CveId":"2435","Ordinal":"3","NoteData":"2017-07-10","Type":"Other","Title":"Modified"}]}}}