|
||
| Editor Login | Register | ||
| > World > Security |
|
|
| BusinessObjects XI cms Cross-Site Scripting Vulnerability | ||||||||||||||||||||||||
Sebastien gioria has reported a vulnerability in BusinessObjects XI, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the "cms" parameter when logging in is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user"s browser session in context of an affected site. The vulnerability is reported in BusinessObjects XI R2 SP1, SP2, and SP3 prior to FixPack 3.5 (Java version). NOTE: The .NET version is reportedly not affected. Solution: Apply FixPack 3.5. http://support.businessobjects.com/downloads/critical_hot_fixes/default.asp Provided and/or discovered by: Sebastien gioria Original Advisory: http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061428.html | ||||||||||||||||||||||||
|
| Bağlantılar: bilgininefendisi.net |
| Open Source Document Project | AUP&TOS |
