CVE-2008-1894

Description

Cross-site scripting (XSS) vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/41875

https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-1894

http://www.securityfocus.com/bid/28762

http://secunia.com/advisories/29804

http://resources.businessobjects.com/support/communitycs/FilesAndUpdates/boxir2_en_FixPack3.5_readme.pdf?recDnlReq=Record&dnlPath=boxir2_en_FixPack3.5_readme.pdf

http://osvdb.org/51450

http://marc.info/?l=bugtraq&m=120818789018302&w=2

http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061428.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS