Unscored severity · published Dec 31, 2004
CVE-2004-2742
Cross-site scripting (XSS) vulnerability in the report viewer in Crystal Enterprise 8.5, 9, and 10 allows remote attackers to inject arbitrary web script or HTML via script in the…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the report viewer in Crystal Enterprise 8.5, 9, and 10 allows remote attackers to inject arbitrary web script or HTML via script in the URL to a report (RPT) file.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Crystal Enterprise · Businessobjects
8.5; 8.5; 8.5; 9; 10; 10; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2742
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2742
Patch
http://secunia.com/advisories/13644
securitytracker.com
http://securitytracker.com/id?1012703
Patch
http://support.businessobjects.com/library/kbase/articles/c2016559.asp
Patch
http://www.osvdb.org/12596
Patch
http://www.securityfocus.com/bid/12107
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/18684
More from Crystal Enterprise
–
CVE-2006-4099
Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values
–
CVE-2004-0204
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook…
–
CVE-2004-1981
The web interface for Crystal Reports allows remote attackers to cause a denial of service (disk exhaustion) by repeatedly requesting reports without retrieving the associated…