Unscored severity · published Aug 12, 2009
CVE-2008-6945
Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 before 5.7.1, 5.6 before 5.6.1, and 5.4 before 5.4.3 allow remote attackers to inject arbitrary web script…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 before 5.7.1, 5.6 before 5.6.1, and 5.4 before 5.4.3 allow remote attackers to inject arbitrary web script or HTML via (1) the mv_order_item CGI variable parameter in Core, (2) the country-select widget, or (3) possibly the value specifier when used in the UserTag feature.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Interchange · Icdevgroup
5.4.0; 5.4.1; 5.4.2; 5.6.0; 5.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6945
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6945
Vendor Advisory
http://ftp.icdevgroup.org/interchange/5.7/WHATSNEW
osvdb.org
http://osvdb.org/49852
osvdb.org
http://osvdb.org/49853
Vendor Advisory
http://secunia.com/advisories/32658
Patch
http://www.icdevgroup.org/i/dev/news?id=ssEkj9j8&mv_arg=00030&mv_pc=96
www.securityfocus.com
http://www.securityfocus.com/bid/32297
More from Interchange
–
CVE-2008-2424
Unspecified vulnerability in the 404 error page for the "Standard demo" in Interchange before 5.6.0 and before 5.5.2 has unknown impact and attack vectors