Unscored severity · published Nov 25, 2008
CVE-2008-5225
Multiple cross-site scripting (XSS) vulnerabilities in Xerox DocuShare 6 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default…
–
CVSS
4.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Xerox DocuShare 6 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) SearchResults/ and (2) Services/ in dsdn/dsweb/, and (3) the default URI under unspecified docushare/dsweb/ServicesLib/Group-#/ directories.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Docushare · Xerox
through 6; 4; 5; 5.00.00.2; 6.0; 6.00.00.1; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5225
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5225
Vendor Advisory
http://secunia.com/advisories/30426
securityreason.com
http://securityreason.com/securityalert/4638
www.securityfocus.com
http://www.securityfocus.com/archive/1/492766/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/492960/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/29430
www.securitytracker.com
http://www.securitytracker.com/id?1020147
More from Docushare
–
CVE-2014-3138
SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users…