{"api_version":"1","generated_at":"2026-06-10T19:26:14+00:00","cve":"CVE-2009-3440","urls":{"html":"https://cve.report/CVE-2009-3440","api":"https://cve.report/api/cve/CVE-2009-3440.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-3440","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-3440"},"summary":{"title":"CVE-2009-3440","description":"Cross-site scripting (XSS) vulnerability in Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI (aka the main menu).","state":"PUBLISHED","assigner":"mitre","published_at":"2009-09-28 22:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/36504","name":"http://www.securityfocus.com/bid/36504","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"OSSIM SQL Injection, Cross Site Scripting and Unauthorized Access Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://dsecrg.com/pages/vul/show.php?id=155","name":"http://dsecrg.com/pages/vul/show.php?id=155","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Digital Security Research Group - [DSECRG-09-055] OSSIM 2.1 - Multiple security vulnerabilities","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/36867","name":"http://secunia.com/advisories/36867","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"OSSIM Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/506663/100/0/threaded","name":"http://www.securityfocus.com/archive/1/506663/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3440","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3440","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"3440","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"alienvault","cpe5":"ossim","cpe6":"1.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3440","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"alienvault","cpe5":"ossim","cpe6":"1.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3440","vulnerable":"1","versionEndIncluding":"2.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"alienvault","cpe5":"ossim","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T06:31:10.295Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://dsecrg.com/pages/vul/show.php?id=155"},{"name":"36504","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/36504"},{"name":"36867","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/36867"},{"name":"20090923 [DSECRG-09-055] OSSIM 2.1 - Multiple security vulnerabilities","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/506663/100/0/threaded"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-09-21T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI (aka the main menu)."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-10T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://dsecrg.com/pages/vul/show.php?id=155"},{"name":"36504","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/36504"},{"name":"36867","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/36867"},{"name":"20090923 [DSECRG-09-055] OSSIM 2.1 - Multiple security vulnerabilities","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/506663/100/0/threaded"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-3440","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI (aka the main menu)."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://dsecrg.com/pages/vul/show.php?id=155","refsource":"MISC","url":"http://dsecrg.com/pages/vul/show.php?id=155"},{"name":"36504","refsource":"BID","url":"http://www.securityfocus.com/bid/36504"},{"name":"36867","refsource":"SECUNIA","url":"http://secunia.com/advisories/36867"},{"name":"20090923 [DSECRG-09-055] OSSIM 2.1 - Multiple security vulnerabilities","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/506663/100/0/threaded"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-3440","datePublished":"2009-09-28T22:00:00.000Z","dateReserved":"2009-09-28T00:00:00.000Z","dateUpdated":"2024-08-07T06:31:10.295Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-09-28 22:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:alienvault:ossim:*:*:*:*:*:*:*:*","versionEndIncluding":"2.1","matchCriteriaId":"D331ECC2-2709-4A3E-ACDB-174CA343C082"},{"vulnerable":true,"criteria":"cpe:2.3:a:alienvault:ossim:1.0.4:*:*:*:*:*:*:*","matchCriteriaId":"6078DC17-1842-4C1E-A550-6F00DCC8D246"},{"vulnerable":true,"criteria":"cpe:2.3:a:alienvault:ossim:1.0.6:*:*:*:*:*:*:*","matchCriteriaId":"910427FD-DFC6-452F-8F8D-8235AD0036A5"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"3440","Ordinal":"1","Title":"CVE-2009-3440","CVE":"CVE-2009-3440","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"3440","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI (aka the main menu).","Type":"Description","Title":"CVE-2009-3440"},{"CveYear":"2009","CveId":"3440","Ordinal":"2","NoteData":"2009-09-28","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"3440","Ordinal":"3","NoteData":"2018-10-10","Type":"Other","Title":"Modified"}]}}}