CVE:CVE-2008-2035
CNNVD:CNNVD-200804-452
Bluemoon存在跨站脚本漏洞在(1) BackPack 0.91 及其早期版本, (2) BmSurvey 0.84 及其早期版本, (3) newbb_fileup 1.83 及其早期版本, (4) News_embed (news_fileup) 1.44 及其早期版本, 以及 (5) XOOPS 2.0.x, XOOPS Cube 2.1, 和 ImpressCMS PopnupBlog 3.19 及其早期版本的Bluemoon, Inc中存在的跨站脚本攻击漏洞会允许远程攻击者通过未明向量来注入任意web脚本或HTML。
solution:Upgrade bluemoon backpack to a higher version than 0.91,and avoid the version (,0.91]; Upgrade bluemoon bmsurvey to a higher version than 0.84,and avoid the version (,0.84]; Upgrade bluemoon newbb_fileup to a higher version than 1.83,and avoid the version (,1.83]; Upgrade bluemoon news_fileup to a higher version than 1.44,and avoid the version (,1.44]; Upgrade bluemoon popnupblog to a higher version than 3.19,and avoid the version (,3.19]; Upgrade xoops xoops to a higher version than 2.0,and avoid the version 2.0; Upgrade xoops xoops_cube to a higher version than 2.1,and avoid the version 2.1