CVE-2009-3731: Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server...

Description

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

Metrics

EPSS Probability

2.78%

84.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-79

Affected Software

Vendor	Product	Versions
Webworks	Epublisher	9.0
Webworks	Epublisher	9.1
Webworks	Epublisher	9.2
Webworks	Epublisher	9.3
Webworks	Epublisher	2008.1
Webworks	Epublisher	2008.2
Webworks	Epublisher	2008.3
Webworks	Epublisher	2008.4
Webworks	Epublisher	2009.1
Webworks	Epublisher	2009.2
Webworks	Help	2.0
Webworks	Help	3.0
Webworks	Help	4.0
Webworks	Help	5.0
Webworks	Publisher	6.0
Webworks	Publisher	7.0
Webworks	Publisher	8.0
Webworks	Publisher	2003
Vmware	Vcenter	4.0
Vmware	Esx Server	4.0
Vmware	Lab Manager	2.0
Vmware	Server	2.0.2
Vmware	Stage Manager	<= 4.0
Vmware	Stage Manager	1.0
Vmware	Vcenter Lab Manager	3.0
Vmware	Vcenter Lab Manager	3.0.1
Vmware	Vcenter Lab Manager	3.0.2
Vmware	Vcenter Lab Manager	4.0
Vmware	Vcenter Stage Manager	1.0.1

References

Timeline

Published: Dec 16, 2009
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2009-3731?

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

How severe is CVE-2009-3731?

Severity scoring for CVE-2009-3731 is pending analysis. The EPSS model estimates a 2.78% probability of exploitation in the next 30 days.

How do I fix CVE-2009-3731?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.