CVE-2008-2035 Cross-site scripting (XSS) vulnerability in the Bluemoon, Inc. (1) BackPack 0.91 and earlier, (2) BmSurvey 0.84 and earlier, (3) newbb_fileup 1.83 and earlier, (4) News_embed (news_fileup) 1.44 and ea...
MediumCVSS 4.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the Bluemoon, Inc. (1) BackPack 0.91 and earlier, (2) BmSurvey 0.84 and earlier, (3) newbb_fileup 1.83 and earlier, (4) News_embed (news_fileup) 1.44 and earlier, and (5) PopnupBlog 3.19 and earlier modules for XOOPS 2.0.x, XOOPS Cube 2.1, and ImpressCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bluemoon backpack | <= 0.91 | No fix listed |
| bluemoon bmsurvey | <= 0.84 | No fix listed |
| bluemoon newbb fileup | <= 1.83 | No fix listed |
| bluemoon news fileup | <= 1.44 | No fix listed |
| bluemoon popnupblog | <= 3.19 | No fix listed |
| xoops | = 2.0 | No fix listed |
| xoops cube | = 2.1 | No fix listed |
References
- JVN#31351020 third-party-advisory
- 29993 third-party-advisory vendor-advisory
- www.bluemooninc.biz
- 28966 vdb-entry
- bluemoon-unspecified-xss(42072) vdb-entry