vulnwire
4.3med

CVE-2008-52253 exploits

Multiple cross-site scripting (XSS) vulnerabilities in Xerox DocuShare 6 and earlier allow remote attackers to inject arbitrary web script…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.1%
percentile 91%
Public exploits
3
Exploit-DB

Multiple cross-site scripting (XSS) vulnerabilities in Xerox DocuShare 6 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) SearchResults/ and (2) Services/ in dsdn/dsweb/, and (3) the default URI under unspecified docushare/dsweb/ServicesLib/Group-#/ directories.

Exploit prediction (EPSS)

4.10% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

Exploits and detections

  • EDB-31864 Xerox DocuShare 6 - docushare/dsweb/ServicesLib/Group URI Cross-Site Scripting · remote · 2008-05-29
  • EDB-31863 Xerox DocuShare 6 - dsdn/dsweb/Services/User URI Cross-Site Scripting · remote · 2008-05-29
  • EDB-31862 Xerox DocuShare 6 - dsdn/dsweb/SearchResults URI Cross-Site Scripting · remote · 2008-05-29

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • securityfocus.com /archive/1/492766/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /archive/1/492960/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • docushare.xerox.com /doug/dsweb/Get/Document-20353/SA30426-workaround.html · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/29430 · vdb-entry, x_refsource_BID, x_transferred
  • vupen.com /english/advisories/2008/1701/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • securitytracker.com /id?1020147 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • secunia.com /advisories/30426 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • docushare.xerox.com /doug/dsweb/View/Collection-7503 · x_refsource_MISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/42748 · vdb-entry, x_refsource_XF, x_transferred
  • securityreason.com /securityalert/4638 · third-party-advisory, x_refsource_SREASON, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.