CVE-2009-0417

Published: Feb 10, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the AgaviWebRouting::gen(null) method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not strictly follow RFC 3986, such as Internet Explorer 6 and 7.

Affected (32)

Products: Agavi: Agavi

Agavi

1 product

Agavi

Configuration A

32 vulnerable

Vulnerable Software	Affected Versions
Agavi Agavi	Version 0.11.0
Agavi Agavi	Version 0.11.0 rc1
Agavi Agavi	Version 0.11.0 rc2
Agavi Agavi	Version 0.11.0 rc3
Agavi Agavi	Version 0.11.0 rc4
Agavi Agavi	Version 0.11.0 rc5
Agavi Agavi	Version 0.11.0 rc6
Agavi Agavi	Version 0.11.0 rc7
Agavi Agavi	Version 0.11.1
Agavi Agavi	Version 0.11.1 rc1
Agavi Agavi	Version 0.11.1 rc2
Agavi Agavi	Version 0.11.1 rc3
Agavi Agavi	Version 0.11.2
Agavi Agavi	Version 0.11.2 rc1
Agavi Agavi	Version 0.11.2 rc2
Agavi Agavi	Version 0.11.3
Agavi Agavi	Version 0.11.3 rc1
Agavi Agavi	Version 0.11.3 rc2
Agavi Agavi	Version 0.11.4
Agavi Agavi	Version 0.11.4 rc1
Agavi Agavi	Version 0.11.5
Agavi Agavi	Version 0.11.5 rc1
Agavi Agavi	Version 0.11.6
Agavi Agavi	Version 0.11.6 rc1
Agavi Agavi	Version 0.11.6 rc2
Agavi Agavi	Version 1.0.0 beta1
Agavi Agavi	Version 1.0.0 beta2
Agavi Agavi	Version 1.0.0 beta3
Agavi Agavi	Version 1.0.0 beta4
Agavi Agavi	Version 1.0.0 beta5
Agavi Agavi	Version 1.0.0 beta6
Agavi Agavi	Version 1.0.0 beta7