Multiple cross-site scripting (XSS) vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary web script or HTML vi…

published 2008-04-27 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-1967

cvss: 3.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits: 3; Exploit-DB

Multiple cross-site scripting (XSS) vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary web script or HTML via the (1) LookUPId and (2) CbFun parameters to (a) CFLookUP.asp; (3) TitleParms, (4) WidgetsHeights, (5) WidgetsLinks, and (6) WidgetsTitles parameters to (b) CznCommon/CznCustomContainer.asp, (7) CFTARGET parameter to (c) home.asp, (8) PersonOid parameter to (d) PeopleWeb/Cards/CVCard.asp, (9) DESTLINKOID and PersonOID parameters to (e) PeopleWeb/Cards/PayrollCard.asp, and the (10) FolderTemplateId and (11) FolderTemplateName parameters to (f) PeopleWeb/CznDocFolder/CznDFStartProcess.asp.

Timeline

2008-04-14 First public exploit (EDB-31646)
2008-04-27 Published

Exploit prediction

1.31% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-31646 Cezanne 6.5.1/7 - 'home.asp?CFTARGET' Cross-Site Scripting webapps, 2008-04-14
EDB-31645 Cezanne 6.5.1/7 - 'CznCustomContainer.asp' Multiple Cross-Site Scripting Vulnerabilities webapps, 2008-04-14
EDB-31644 Cezanne 6.5.1/7 - 'cflookup.asp' Multiple Cross-Site Scripting Vulnerabilities webapps, 2008-04-14
securityfocus.com http://www.securityfocus.com/bid/28772 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	3.5	AV:N/AC:M/Au:S/C:N/I:P/A:N

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

securityfocus.com /bid/28772
vdb-entry, exploit
securityfocus.com /archive/1/490846/100/0/threaded
mailing-list
exchange.xforce.ibmcloud.com /vulnerabilities/41821
vdb-entry
securityreason.com /securityalert/3829
third-party-advisory
s21sec.com /es/avisos/s21sec-042-en.txt

Sources

CVE List CVE-2008-1969
NVD CVE-2008-1969

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary