This script is Copyright (C) 2011-2014 Tenable Network Security, Inc.
The remote web server hosts a JSP script that is prone to a cross-
site scripting attack.
The InfoView component included with the Crystal Reports Server
install on the remote host contains a JSP script fails to sanitize
user input to the 'logonAction' parameter of its 'logon.jsp' script
before using it to generate dynamic HTML output.
An attacker may be able to leverage this issue to inject arbitrary
HTML or script code into a user's browser to be executed within the
security context of the affected site.
Note that this install is likely affected by other cross-site
scripting issues as well as a directory traversal vulnerability,
although Nessus has not checked for them.
See also :
See https://service.sap.com/sap/support/notes/1458310 (requires
Risk factor :
Medium / CVSS Base Score : 4.3
CVSS Temporal Score : 3.6
Public Exploit Available : true
Family: CGI abuses : XSS
Nessus Plugin ID: 51816 ()
Bugtraq ID: 45980