Vulnerability Report

CVE-2009-1907

Title: Claroline Cross-Site Scripting (XSS)

XSS

Proof Of Concept

PoC Available for CVE-2009-1907

CWE Category CWE-79
Published Date Jun 04, 2009
Modified Date Jun 16, 2026
Exploit Status Available
Score 4.3 CVSS v2.0
Exploit Probability (EPSS)
1.83%

Vulnerability Summary

CVE-2009-1907: Cross-site scripting (XSS) vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.

Impacted Vendors

C
claroline 1

Reference Links

http://forum.claroline.net/viewtopic.php?f=69&t=16193&p=42102#p42099 http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html http://secunia.com/advisories/35019 http://www.securityfocus.com/archive/1/503365/100/0/threaded http://www.securityfocus.com/bid/34883 http://www.securitytracker.com/id?1022198 https://exchange.xforce.ibmcloud.com/vulnerabilities/50404 http://forum.claroline.net/viewtopic.php?f=69&t=16193&p=42102#p42099 http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html http://secunia.com/advisories/35019 http://www.securityfocus.com/archive/1/503365/100/0/threaded http://www.securityfocus.com/bid/34883 http://www.securitytracker.com/id?1022198 https://exchange.xforce.ibmcloud.com/vulnerabilities/50404
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
4.3
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2009-1907 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/32991
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected Stack

No specific products linked.