CVE-2009-4839: Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE), possibly...

Security readout for executives and security teams

This is an old cross-site scripting issue in Basic Analysis and Security Engine. If an affected BASE interface is reachable, an attacker could inject script or HTML into certain administrative, configuration, query, or alert-group pages. The sources do not provide severity scoring, confirmed fixed versions, or evidence of active exploitation. Exposure is most likely limited to organizations still running legacy BASE, especially possibly 1.4.4 or earlier, where the web interface is reachable. The source bundle does not define exact affected CPEs, authentication requirements, or deployment prevalence. Treat this as a legacy application hygiene issue unless BASE is exposed or business-critical. Escalate if the interface is internet-facing, used by privileged security staff, or cannot be patched or isolated. Mitigation focus: Inventory BASE deployments and identify installed versions.; Check BASE or SecureIdeas project guidance for fixed releases or code changes.; Restrict BASE access to trusted administrators and networks..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.