CVE-2009-0237
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication...
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."
- Record
CVE-2009-0237- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."
- Record
CVE-2009-0237- Updated
- 2026-11-02
EUVDEUVD-2009-0245 No score
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."
- Record
EUVD-2009-0245- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xxfx-h76g-4vhr No score
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication...
Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."
- Record
GHSA-xxfx-h76g-4vhr- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0237 is a medium vulnerability (CVSS 4.3) in Microsoft Forefront Threat Management Gateway, published April 15, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.8%, the 97th percentile. No source names a fixed version.
References
docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-016
osvdb.org/53637
us-cert.gov/cas/techalerts/TA09-104A.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5771
vupen.com/english/advisories/2009/1030
securitytracker.com/id?1022046
secunia.com/advisories/34687
nvd.nist.gov/vuln/detail/CVE-2009-0237
github.com/advisories/GHSA-xxfx-h76g-4vhr