Unscored CVE-2008-1894 EUVD-2008-1894GHSA-phc9-wg8m-34wx

Cross-site scripting (XSS) vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 J…

Published Apr 18, 2008 · Updated Aug 7, 2024 · Assigned by mitre

Description

Cross-site scripting (XSS) vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter.

References

http://resources.businessobjects.com/support/communitycs/FilesAndUpdates/boxir2_en_FixPack3.5_readme.pdf?recDnlReq=Record&dnlPath=boxir2_en_FixPack3.5_readme.pdf
29804 third-party-advisory
20080413 DOINGSOFT-2008-03-10-001 - XSS issue in BOXiR2 mailing-list
28762 vdb-entry
20080413 DOINGSOFT-2008-03-10-001 - XSS issue in BOXiR2 mailing-list
businessobjects-cms-xss(41875) vdb-entry
51450 vdb-entry