CVE-2008-1894

BusinessObjects InfoView XI <FixPack 3.5 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter.

References (7)

[Exploit] http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061428.html

[Mailing List] http://marc.info/?l=bugtraq&m=120818789018302&w=2

[Third Party Advisory, VDB Entry] http://osvdb.org/51450

[Various Sources] http://resources.businessobjects.com/support/communitycs/FilesAndUpdates/boxir2_en_FixPack3.5_readme.pdf?recDnlReq=Record&dnlPath=boxir2_en_FixPack3.5_readme.pdf

[Patch, Vendor Advisory] http://secunia.com/advisories/29804

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/28762

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/41875

Scores

EPSS 0.0053

EPSS Percentile 66.9%

Classification

CWE

CWE-79

Status draft

Affected Products (7)

businessobjects/infoview < xi_r2

businessobjects/infoview < xi_r2

businessobjects/infoview < xi_r2

businessobjects/infoview < xi_r2

businessobjects/infoview < xi_r2

businessobjects/infoview

businessobjects/infoview

Timeline

Published Apr 18, 2008

Tracked Since Feb 18, 2026