Detections
Analytics
SAP BusinessObjects viewError.jsp 'error' Parameter XSS
medium Nessus Plugin ID 44343
Language:
Synopsis
A web application on the remote host has a cross-site scripting vulnerability.Description
The version of SAP BusinessObjects installed on the remote web server has a cross-site scripting vulnerability. Input passed to the 'error' parameter of '/PerformanceManagement/jsp/viewError.jsp' is not properly sanitized.A remote attacker could exploit this by tricking a user into requesting a specially crafted URL, resulting in the execution of arbitrary script code.
This version of BusinessObjects reportedly has several other vulnerabilities, though Nessus has not checked for those issues.
Solution
Contact the vendor for a fix.See Also
Plugin Details
Severity: Medium
ID: 44343
File Name: sap_bobj_viewerror_xss.nasl
Version: 1.13
Type: remote
Family: CGI abuses : XSS
Published: 2/1/2010
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 4.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:sap:businessobjects
Required KB Items: www/sap_bobj
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 1/18/2010