Vulnerability Intelligence Report
CVE-2009-0237
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."
No Active Exploit Signals
CVSS Base Score
4.3
MEDIUM
EPSS Probability:22.85%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| microsoft | forefront_threat_management_gateway | all |
| microsoft | internet_security_and_acceleration_server | 2004, 2006 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
22.849%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Microsoft Corporation · Vendor · USA |
| Reserved | 2009-01-20T00:00:00 |
| Published | 2009-04-15T03:49:00 |
| Patch Date | 2009-04-14 |
| Last Updated | 2024-08-07T04:24:18 |
Community Chatter & Buzz