Every CVESearch/Get API key

CVE-2009-3300

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1...

2.6 LowFix available

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

Exploit likelihood

1.67%Up 0.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used2.6

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

Record
CVE-2009-3300
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE ListNo score

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

Record
CVE-2009-3300
Updated
2026-11-02
EUVDEUVD-2009-3282No score

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

Record
EUVD-2009-3282
Updated
2026-11-03
GitHub AdvisoriesGHSA-xjxx-h5w2-fphmNo score

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1...

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

Record
GHSA-xjxx-h5w2-fphm
Weakness
CWE-79
Updated
2026-11-02
OSVNo score

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

Record
CVE-2009-3300
Updated
2026-11-02
OSVDEBIAN-CVE-2009-3300No score

Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary web script or HTML via URLs that are encountered in redirections, and appear in automatically generated forms.

Record
DEBIAN-CVE-2009-3300
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
shibboleth-sp
Debian:12
before 3.0.2+dfsg1-2
3.0.2+dfsg1-2
shibboleth-sp
Debian:13
before 3.0.2+dfsg1-2
3.0.2+dfsg1-2
shibboleth-sp
Debian:14
before 3.0.2+dfsg1-2
3.0.2+dfsg1-2
shibboleth-sp
Debian:4.0
before 1.3f.dfsg1-2+etch2, plus listed versions
1.3f.dfsg1-21.3f.dfsg1-2+etch1
1.3f.dfsg1-2+etch2
opensaml2
Debian:5.0
before 2.0-2+lenny2, plus listed versions
2.0-22.0-2+lenny1
2.0-2+lenny2
shibboleth-sp2
Debian:5.0
before 2.0.dfsg1-4+lenny2, plus listed versions
2.0.dfsg1-42.0.dfsg1-4+lenny1
2.0.dfsg1-4+lenny2
shibboleth-sp
Debian:5.0
before 1.3.1.dfsg1-3+lenny2, plus listed versions
1.3.1.dfsg1-31.3.1.dfsg1-3+lenny11.3.1.dfsg1-3+lenny1~bpo40+11.3.1.dfsg1-3+lenny2~bpo40+1
1.3.1.dfsg1-3+lenny2

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-3300 is a low vulnerability (CVSS 2.6) in Internet2 Identity Provider, published November 6, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.67%, the 77th percentile. Fixed in shibboleth-sp 3.0.2+dfsg1-2.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open