Unscored severity · published Mar 9, 2014
CVE-2013-6233
Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short…
–
CVSS
3.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field in the "Short document metadata."
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spagobi · Eng
through 4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6233
Exploit
http://packetstormsecurity.com/files/125496
Exploit
http://www.exploit-db.com/exploits/32039
www.securityfocus.com
http://www.securityfocus.com/archive/1/531322/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/65915
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/91506
More from Spagobi
9.1
CVE-2024-54794
The script input feature of SpagoBI 3.5.1 allows arbitrary code execution
8.8
CVE-2013-6231
SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script
8.0
CVE-2013-6234
Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an…
6.1
CVE-2024-54792
A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel
5.4
CVE-2024-54795
SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function