CVE-2008-5228

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-11-25 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in IBM Workplace Content Management (WCM) 6.0G and 6.1 before CF8, when a Page Navigation Component shows menu entries, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in the URI, related to parameters "not being encoded."

Affected products

IBM Workplace Content Management: 6.0, 6.1

References

http://secunia.com/advisories/32763
http://www-01.ibm.com/support/docview.wss?uid=swg1PK73108
http://www-01.ibm.com/support/docview.wss?uid=swg1PK73933
http://www.securityfocus.com/bid/32408
http://www.vupen.com/english/advisories/2008/3234
https://exchange.xforce.ibmcloud.com/vulnerabilities/46749
http://secunia.com/advisories/32763
http://www-01.ibm.com/support/docview.wss?uid=swg1PK73108
http://www-01.ibm.com/support/docview.wss?uid=swg1PK73933
http://www.securityfocus.com/bid/32408
http://www.vupen.com/english/advisories/2008/3234
https://exchange.xforce.ibmcloud.com/vulnerabilities/46749

Get alerted when CVE-2008-5228 or the next vulnerability affects your stack