Unscored severity · published Sep 17, 2004
CVE-2004-0534
Cross-site scripting (XSS) vulnerability in Business Objects InfoView 5.1.4 through 5.1.8 for WebIntelligence 2.7.0 through 2.7.4 allows remote attackers to inject arbitrary web…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Business Objects InfoView 5.1.4 through 5.1.8 for WebIntelligence 2.7.0 through 2.7.4 allows remote attackers to inject arbitrary web script or HTML via document names when uploading a document.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Infoview · Businessobjects
5.1.4; 5.1.5; 5.1.6; 5.1.7; 5.1.8 · source: NVD
WE
Webintelligence · Businessobjects
2.7; 2.7.1; 2.7.2; 2.7.3; 2.7.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0534
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0534
Patch
http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0057.html
Patch
http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026550.html
Patch
http://secunia.com/advisories/12587/
www.securityfocus.com
http://www.securityfocus.com/bid/11209
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/17419
More from Infoview
–
CVE-2008-1894
Cross-site scripting (XSS) vulnerability in desktoplaunch/InfoView/logon/logon.object in BusinessObjects InfoView XI R2 SP1, SP2, and SP3 Java version before FixPack 3.5 allows…
–
CVE-2004-0533
Business Objects WebIntelligence 2.7.0 through 2.7.4 only enforces access controls on the client, which allows remote authenticated users to delete arbitrary files on the server…