CVE-2008-1894

MEDIUM 4.3CVE-2008-1894 · Published 18/04/2008 · updated 16/06/2026

In short

CVE-2008-1894 is a MEDIUM (CVSS 4.3) vulnerability affecting infoview (businessobjects).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
infoview businessobjects	`= xi_r2≤ xi_r2`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows remote attackers to inject arbitrary web script or HTML via the cms parameter.

References

lists.grok.org.uk/pipermail/full-disclosure/2008-April/061428.html · Exploit
marc.info
osvdb.org/51450
resources.businessobjects.com/support/communitycs/FilesAndUpdates/boxir2_en_FixPack3.5_readme.pdf
secunia.com/advisories/29804 · Patch
securityfocus.com/bid/28762
exchange.xforce.ibmcloud.com/vulnerabilities/41875

More vulnerabilities in infoview

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free