SAP Business Objects Crystal Reports 'viewreport.asp' Cross Site Scripting Vulnerability

Publish date: July 21, 2015
  Severity: MEDIUM
  Advisory Date: JUL 21, 2015

  DESCRIPTION

SAP Business Objects Crystal Reports is prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials. This issue may be related to the issue described in BID 12107 (Business Objects Crystal Enterprise Report File Cross-Site Scripting Vulnerability). This BID will be updated or retired when more information becomes available.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1000552
  Trend Micro Deep Security DPI Rule Name: 1000552 - Generic Cross Site Scripting(XSS) Prevention

  AFFECTED SOFTWARE AND VERSION

  • Business Objects Crystal Reports 10.0
  • Business Objects Crystal Reports 7.0
  • Business Objects Crystal Reports 8.0
  • Business Objects Crystal Reports 9.0
  • Business Objects Crystal Reports Server XI 0
  • Business Objects Crystal Reports XI Professional 0
  • Business Objects Crystal Reports XI Release 2 0
  • Business Objects Crystal Reports for Visual Studio .NET 2002 0
  • Business Objects Crystal Reports for Visual Studio .NET 2003 0
  • Business Objects Crystal Reports for Visual Studio .NET 2005 10.2

Featured Stories