CVE-2009-2705

CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing non-canonical, "overlong Unicode" in place of blacklisted characters.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2009-08-11

Last modified

2024-09-16

Weaknesses

CWE-264

Affected products

• Siteminder (Broadcom)
• J2ee (Sun)

References

• http://i8jesus.com/?p=55