CVE:CVE-2009-4052
CNNVD:CNNVD-200911-235
WebSphere Software 7.0.0.10之前版本和Rational Software Architect 7.0.0.10之前版本的IBM Rational Application Developer中的JSF Widget Library Runtime存在多个跨站脚本攻击漏洞。远程攻击者可以借助涉及(1)JSF Tree Control和(2)JavaScript Resource Servlet的向量，注入任意的web脚本或HTML。
solution:Upgrade ibm rational_application_developer_for_websphere to a higher version than 7.0,7.0.0.1,7.0.0.2,7.0.0.3,7.0.0.4,7.0.0.5,7.0.0.6,7.0.0.7,7.0.0.8,7.0.0.9,and avoid the version 7.0,7.0.0.1,7.0.0.2,7.0.0.3,7.0.0.4,7.0.0.5,7.0.0.6,7.0.0.7,7.0.0.8,7.0.0.9; Upgrade ibm rational_software_architect to a higher version than 7.0.0.0,7.0.0.1,7.0.0.2,7.0.0.3,7.0.0.4,7.0.0.5,7.0.0.6,7.0.0.7,7.0.0.8,7.0.0.9,and avoid the version 7.0.0.0,7.0.0.1,7.0.0.2,7.0.0.3,7.0.0.4,7.0.0.5,7.0.0.6,7.0.0.7,7.0.0.8,7.0.0.9