CVE-2008-1969

Multiple cross-site scripting (XSS) vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary web script or HTML via the (1) LookUPId and (2) CbFun parameters to (a) CFLookUP.asp; (3) TitleParms, (4) WidgetsHeights, (5) WidgetsLinks, and (6) WidgetsTitles parameters to (b) CznCommon/CznCustomContainer.asp, (7) CFTARGET parameter to (c) home.asp, (8) PersonOid parameter to (d) PeopleWeb/Cards/CVCard.asp, (9) DESTLINKOID and PersonOID parameters to (e) PeopleWeb/Cards/PayrollCard.asp, and the (10) FolderTemplateId and (11) FolderTemplateName parameters to (f) PeopleWeb/CznDocFolder/CznDFStartProcess.asp.

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

1.31% chance of exploitation in the next 30 days, 69th percentile

Published

2008-04-27

Updated

2024-08-07

ExploitDB entries (3)

• https://www.exploit-db.com/exploits/31646
• https://www.exploit-db.com/exploits/31645
• https://www.exploit-db.com/exploits/31644

References

• CVE Record
• NVD entry

Related

• CVE-2008-1968
• CVE-2008-1971
• CVE-2008-1967
• CVE-2008-1973
• CVE-2008-1965
• CVE-2008-1974