CVE-2009-3300
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1...
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.
- Record
CVE-2009-3300- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.
- Record
CVE-2009-3300- Updated
- 2026-11-02
EUVDEUVD-2009-3282 No score
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.
- Record
EUVD-2009-3282- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xjxx-h5w2-fphm No score
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1...
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.
- Record
GHSA-xjxx-h5w2-fphm- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.
- Record
CVE-2009-3300- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3300 No score
Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.
- Record
DEBIAN-CVE-2009-3300- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shibboleth-spDebian:12 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:13 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:14 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:4.0 |
before 1.3f.dfsg1-2+etch2, plus listed versions 1.3f.dfsg1-21.3f.dfsg1-2+etch1 |
1.3f.dfsg1-2+etch2 |
opensaml2Debian:5.0 |
before 2.0-2+lenny2, plus listed versions 2.0-22.0-2+lenny1 |
2.0-2+lenny2 |
shibboleth-sp2Debian:5.0 |
before 2.0.dfsg1-4+lenny2, plus listed versions 2.0.dfsg1-42.0.dfsg1-4+lenny1 |
2.0.dfsg1-4+lenny2 |
shibboleth-spDebian:5.0 |
before 1.3.1.dfsg1-3+lenny2, plus listed versions 1.3.1.dfsg1-31.3.1.dfsg1-3+lenny11.3.1.dfsg1-3+lenny1~bpo40+11.3.1.dfsg1-3+lenny2~bpo40+1 |
1.3.1.dfsg1-3+lenny2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3300 is a low vulnerability (CVSS 2.6) in Internet2 Identity Provider, published November 6, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.67%, the 76th percentile. Fixed in shibboleth-sp 3.0.2+dfsg1-2.
References
debian.org/security/2009/dsa-1947
secunia.com/advisories/37237
exchange.xforce.ibmcloud.com/vulnerabilities/54140
vupen.com/english/advisories/2009/3150
shibboleth.internet2.edu/secadv/secadv_20091104.txt
nvd.nist.gov/vuln/detail/CVE-2009-3300
github.com/advisories/GHSA-xjxx-h5w2-fphm
security-tracker.debian.org/tracker/CVE-2009-3300