FKIE_CVE-2009-3444

Vulnerability from fkie_nvd - Published: 2009-09-28 22:30 - Updated: 2026-04-23 00:35
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a news.1 (aka news to email) action.
References
cve@mitre.orghttp://osvdb.org/58363
cve@mitre.orghttp://secunia.com/advisories/36832Vendor Advisory
cve@mitre.orghttp://websecurity.com.ua/3528Exploit
cve@mitre.orghttp://www.securityfocus.com/archive/1/506704/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/36517
cve@mitre.orghttp://www.securitytracker.com/id?1022947
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/58363
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36832Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://websecurity.com.ua/3528Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/506704/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/36517
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1022947
Impacted products
Vendor Product Version
e107 e107 *
e107 e107 0.6_10
e107 e107 0.6_11
e107 e107 0.6_12
e107 e107 0.6_13
e107 e107 0.6_14
e107 e107 0.6_15
e107 e107 0.6_15a
e107 e107 0.7
e107 e107 0.7.1
e107 e107 0.7.2
e107 e107 0.7.3
e107 e107 0.7.4
e107 e107 0.7.5
e107 e107 0.7.6
e107 e107 0.7.7
e107 e107 0.7.8
e107 e107 0.7.9
e107 e107 0.7.10
e107 e107 0.7.11
e107 e107 0.7.12
e107 e107 0.7.13
e107 e107 0.7.14
e107 e107 0.7.15
e107 e107 0.545
e107 e107 0.547_beta
e107 e107 0.548_beta
e107 e107 0.549_beta
e107 e107 0.551_beta
e107 e107 0.552_beta
e107 e107 0.553_beta
e107 e107 0.554
e107 e107 0.554_beta
e107 e107 0.555_beta
e107 e107 0.600
e107 e107 0.601
e107 e107 0.602
e107 e107 0.603
e107 e107 0.604
e107 e107 0.605
e107 e107 0.606
e107 e107 0.607
e107 e107 0.608
e107 e107 0.609
e107 e107 0.610
e107 e107 0.611
e107 e107 0.612
e107 e107 0.613
e107 e107 0.614
e107 e107 0.615
e107 e107 0.615a
e107 e107 0.616
e107 e107 0.617
e107 e107 0.6171
e107 e107 0.6172
e107 e107 0.6173
e107 e107 0.6174
e107 e107 0.6175
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:e107:e107:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "358194A8-3BAB-4CA7-9546-C5A598FA911C",
              "versionEndIncluding": "0.7.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6_10:*:*:*:*:*:*:*",
              "matchCriteriaId": "18C34EB0-7685-4346-81A2-371C1F19F6AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6_11:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB26A2A4-B0DE-4130-AA5F-76D5394A0614",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6_12:*:*:*:*:*:*:*",
              "matchCriteriaId": "90909932-AD39-4648-8621-5866F0C4AB12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6_13:*:*:*:*:*:*:*",
              "matchCriteriaId": "37F208E9-3C39-4D00-B1E0-5CD0B315E740",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6_14:*:*:*:*:*:*:*",
              "matchCriteriaId": "27C7402F-54C9-4FDA-B181-85941DDC7010",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6_15:*:*:*:*:*:*:*",
              "matchCriteriaId": "061B1AF2-2BA7-49CB-9F8B-91BF5D5B0BF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6_15a:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F77F5E4-8636-41F5-9A80-055CC0FC0346",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "70AB914E-D616-45D2-A451-1C247B8B6E4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA03C1AC-97EA-47ED-9558-A7CA48420AB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "32695A82-B042-46B7-9CB4-20F3446E0C9E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6716A040-0CBE-4402-AB2A-1621B1240B0F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "81627355-AB45-4D47-8DD2-4087E6971EF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2DAAA4F-B893-4914-8538-E68DDA211225",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "B649DDC6-EEE6-47E1-A69A-831E5C2DD58C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FEEC90E-8640-4786-B014-CAD83EC4F2E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "E29B9B12-4C94-4A8D-B407-2D288502EFE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5CAADA1-1FBB-4983-A942-FC4490CE8D8E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4D7C699-0E92-4D9C-9D8F-87C39A28ACCD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C62F8AD-EA30-441E-B97F-EF8DE640DC1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "F96C30A8-7E56-4806-B8D7-851D75B08738",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1C22711-AEC4-438F-9B37-64D36B0BDFC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E2AA435-E5FC-4555-B582-5C6FFC99327B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.7.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A81364B-FB65-4591-ACA3-9D5991F0C30C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.545:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DDD8B3B-8580-4624-8D77-E3FD97DFF4A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.547_beta:*:*:*:*:*:*:*",
              "matchCriteriaId": "437C4251-886C-4E94-B7F6-AE34A0142A76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.548_beta:*:*:*:*:*:*:*",
              "matchCriteriaId": "761D4EE9-0D54-4370-BCBC-3C23481C127B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.549_beta:*:*:*:*:*:*:*",
              "matchCriteriaId": "E11E3F9E-708E-44CB-8FD2-E4961028B732",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.551_beta:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F38EB42-437C-4381-B36A-FD3DB78E724E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.552_beta:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECC957BA-D96C-41B7-9BD4-2ECD37C9C924",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.553_beta:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E9E9AC1-5ECD-448F-B72A-1CE8228C2C22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.554:*:*:*:*:*:*:*",
              "matchCriteriaId": "6454D949-83A2-4F69-92E1-BBCD84F21BC2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.554_beta:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FC4B3A4-2563-4C06-A484-5C02CD8F7408",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.555_beta:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC274184-AD8E-4BC2-BC6A-4E64F354BFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.600:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E80F85C-61AD-49C0-9EBF-B79F728F6A97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.601:*:*:*:*:*:*:*",
              "matchCriteriaId": "3FE097FC-A525-4599-9FDA-1A011EECE767",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.602:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FF51B0D-E020-491D-92A9-D2A01A7417AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.603:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8692341-8DF2-4943-853A-4AAF1F313914",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.604:*:*:*:*:*:*:*",
              "matchCriteriaId": "75197306-53DB-4C94-959B-C46D3FB1F42B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.605:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0C5C91C-C1C5-457D-9E09-24C7CACCC280",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.606:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EB88C92-4F62-471A-8C10-C13C890E764F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.607:*:*:*:*:*:*:*",
              "matchCriteriaId": "5585DC36-C65F-4FCA-B26F-E4A7901863E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.608:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C7DD56C-66F7-421C-B211-07C7856112C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.609:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E14B108-228D-454F-AF16-9D9086E4C10B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.610:*:*:*:*:*:*:*",
              "matchCriteriaId": "04C91C45-9A96-4E69-8A0A-D619AB45BC08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.611:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F7C68F4-9ECD-41A9-B4AE-48F028841428",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.612:*:*:*:*:*:*:*",
              "matchCriteriaId": "28B75E28-08DE-4CA2-A60B-FB2F61AEC5BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.613:*:*:*:*:*:*:*",
              "matchCriteriaId": "B9AA824A-CEE6-460B-A668-92FC3A822305",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.614:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A51FBB3-42CE-40E1-A15D-ADDFBF8E203D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.615:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEAC1FD5-ECD1-480C-827E-F1AE8484C4EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.615a:*:*:*:*:*:*:*",
              "matchCriteriaId": "D17F613A-6BE1-4B45-8E40-8E44E0EEA756",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.616:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5CB33E9-9AB8-482A-A196-768A2085A49C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.617:*:*:*:*:*:*:*",
              "matchCriteriaId": "12BD5CAD-0EB8-48F2-AF80-510584A83446",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6171:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD8CD2A8-C8E8-4A5F-8355-6DF45C9DF45C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6172:*:*:*:*:*:*:*",
              "matchCriteriaId": "92E294FE-F0A2-45FC-BB67-D988DD89D2AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6173:*:*:*:*:*:*:*",
              "matchCriteriaId": "9640315B-7F04-4F5A-B213-8FAF509DFF01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6174:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA89549A-6CD7-4DDB-A8C8-ADF103F6CDFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:e107:e107:0.6175:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF75A192-81C1-4F58-A660-7EFE4F33E58B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a news.1 (aka news to email) action."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en email.php en e107 v0.7.16 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de la cabecera HTTP Referer en una acci\u00f3n news.1 (tambi\u00e9n conocida como noticias (news) a correo (email)."
    }
  ],
  "id": "CVE-2009-3444",
  "lastModified": "2026-04-23T00:35:47.467",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-09-28T22:30:00.983",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/58363"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36832"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://websecurity.com.ua/3528"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/506704/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/36517"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1022947"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/58363"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36832"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://websecurity.com.ua/3528"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/506704/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/36517"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1022947"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.