CVE-2004-2550: Multiple cross-site scripting (XSS) vulnerabilities in unspecified Perl scripts in SandSurfer before 1.7.1...

Security readout for executives and security teams

SandSurfer versions before 1.7.1 had multiple cross-site scripting flaws. An attacker could place script or HTML into data that later appears in reports, causing that content to run when a victim views the report. The sources do not provide CVSS, affected components, or evidence of active exploitation. Exposure is likely limited to organizations still running SandSurfer, especially versions earlier than 1.7.1. Internet-accessible reporting interfaces or reports viewed by privileged users would increase business risk. The source bundle does not identify broader affected products or CPEs. Prioritize as a moderate legacy application risk. It is not known to be actively exploited from the provided sources, but stored XSS can affect privileged users and reporting workflows if SandSurfer remains deployed. Mitigation focus: Identify whether SandSurfer is deployed anywhere in the environment.; Upgrade SandSurfer versions earlier than 1.7.1 after checking vendor guidance.; Restrict access to SandSurfer reporting interfaces until version status is confirmed..

Prepared

Jun 29, 2026, 16:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.