CVE Vulnerability

CVE-2008-1894

Cross-site scripting (XSS) vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

References
Link Resource
http://marc.info/?l=bugtraq&m=120818789018302&w=2
http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061428.html Exploit
http://resources.businessobjects.com/support/communitycs/FilesAndUpdates/boxir2_en_FixPack3.5_readme.pdf?recDnlReq=Record&dnlPath=boxir2_en_FixPack3.5_readme.pdf
http://secunia.com/advisories/29804 Patch Vendor Advisory
http://www.securityfocus.com/bid/28762
http://osvdb.org/51450
https://exchange.xforce.ibmcloud.com/vulnerabilities/41875
Configurations

Configuration 1

cpe:2.3:a:businessobjects:infoview:*:sp3_ft3.2:*:*:*:*:*:*
cpe:2.3:a:businessobjects:infoview:*:sp3_ft3.0:*:*:*:*:*:*
cpe:2.3:a:businessobjects:infoview:xi_r2:sp1:*:*:*:*:*:*
cpe:2.3:a:businessobjects:infoview:*:sp3_ft3.3:*:*:*:*:*:*
cpe:2.3:a:businessobjects:infoview:*:sp3_ft3.1:*:*:*:*:*:*
cpe:2.3:a:businessobjects:infoview:xi_r2:sp2:*:*:*:*:*:*
cpe:2.3:a:businessobjects:infoview:*:sp3_fp3.4:*:*:*:*:*:*
Information

Published : 2008-04-18 10:05

Updated : 2017-08-08 01:30

NVD link : CVE-2008-1894

Mitre link : CVE-2008-1894

Products Affected
No products.
CWE
CWE-79