Read the docs
TI-2009-04236 Aliases CVE-2009-4473GHSA-cfpf-233f-2c4q

Multiple cross-site scripting (XSS) vulnerabilities in…

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in WorkArea/ContentDesigner/ekformsiframe.aspx in Ektron CMS400.NET 7.6.1.53 and 7.6.6.47, and possibly 7.52 through 7.66sp2, allow remote attackers to inject arbitrary web script or HTML via the (1) css, (2) eca, (3) id, and (4) skin parameters. NOTE: some of these details are obtained from third party information.

Why it matters now

EPSS 0.01223 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:ektron:cms4000.net:7.6.0:*:*:*:*:*:*:*7.6.0VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.0:sp1:*:*:*:*:*:*7.6.0 sp1VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.0:sp2:*:*:*:*:*:*7.6.0 sp2VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.1:*:*:*:*:*:*:*7.6.1VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.1:sp1:*:*:*:*:*:*7.6.1 sp1VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.1:sp2:*:*:*:*:*:*7.6.1 sp2VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.1:sp3:*:*:*:*:*:*7.6.1 sp3VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.1:sp4:*:*:*:*:*:*7.6.1 sp4VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.1.53:*:*:*:*:*:*:*7.6.1.53VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.5:*:*:*:*:*:*:*7.6.5VulnerableEktron
  • cpe:2.3:a:ektron:cms4000.net:7.6.0:*:*:*:*:*:*:* Versions 7.6.0 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.0:sp1:*:*:*:*:*:* Versions 7.6.0 sp1 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.0:sp2:*:*:*:*:*:* Versions 7.6.0 sp2 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.1:*:*:*:*:*:*:* Versions 7.6.1 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.1:sp1:*:*:*:*:*:* Versions 7.6.1 sp1 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.1:sp2:*:*:*:*:*:* Versions 7.6.1 sp2 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.1:sp3:*:*:*:*:*:* Versions 7.6.1 sp3 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.1:sp4:*:*:*:*:*:* Versions 7.6.1 sp4 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.1.53:*:*:*:*:*:*:* Versions 7.6.1.53 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.5:*:*:*:*:*:*:* Versions 7.6.5 Vulnerable ·Ektron
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ektron:cms4000.net:7.6.5:sp1:*:*:*:*:*:*7.6.5 sp1VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.5:sp2:*:*:*:*:*:*7.6.5 sp2VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.5:sp3:*:*:*:*:*:*7.6.5 sp3VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.6:*:*:*:*:*:*:*7.6.6VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.6:sp1:*:*:*:*:*:*7.6.6 sp1VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.6:sp2:*:*:*:*:*:*7.6.6 sp2VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.6.6.47:*:*:*:*:*:*:*7.6.6.47VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.52:*:*:*:*:*:*:*7.52VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.53:*:*:*:*:*:*:*7.53VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.53:sp2:*:*:*:*:*:*7.53 sp2VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.54:*:*:*:*:*:*:*7.54VulnerableEktron
cpe:2.3:a:ektron:cms4000.net:7.54:sp2:*:*:*:*:*:*7.54 sp2VulnerableEktron
  • cpe:2.3:a:ektron:cms4000.net:7.6.5:sp1:*:*:*:*:*:* Versions 7.6.5 sp1 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.5:sp2:*:*:*:*:*:* Versions 7.6.5 sp2 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.5:sp3:*:*:*:*:*:* Versions 7.6.5 sp3 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.6:*:*:*:*:*:*:* Versions 7.6.6 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.6:sp1:*:*:*:*:*:* Versions 7.6.6 sp1 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.6:sp2:*:*:*:*:*:* Versions 7.6.6 sp2 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.6.6.47:*:*:*:*:*:*:* Versions 7.6.6.47 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.52:*:*:*:*:*:*:* Versions 7.52 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.53:sp2:*:*:*:*:*:* Versions 7.53 sp2 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.54:*:*:*:*:*:*:* Versions 7.54 Vulnerable ·Ektron
  • cpe:2.3:a:ektron:cms4000.net:7.54:sp2:*:*:*:*:*:* Versions 7.54 sp2 Vulnerable ·Ektron

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-4473
  2. 2026-10-03 Alias added: GHSA-cfpf-233f-2c4q

References

Patch 1

Other 2

  • TI-2008-03351 Unspecified vulnerability in "a page in the workarea folder" in Ektron CMS400.NET 7.00… CVSS 2.0HIGH 10.0
  • TI-2008-04873 SQL injection vulnerability in WorkArea/ContentRatingGraph.aspx in Ektron CMS400.NET… CVSS 2.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences