{"api_version":"1","generated_at":"2026-07-23T11:32:41+00:00","cve":"CVE-2009-1635","urls":{"html":"https://cve.report/CVE-2009-1635","api":"https://cve.report/api/cve/CVE-2009-1635.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-1635","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-1635"},"summary":{"title":"CVE-2009-1635","description":"Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-05-22 16:48:42","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/35061","name":"http://www.securityfocus.com/bid/35061","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Novell GroupWise WebAccess 'gw/webacc' Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2009/1393","name":"http://www.vupen.com/english/advisories/2009/1393","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/503700/100/0/threaded","name":"http://www.securityfocus.com/archive/1/503700/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1022267","name":"http://securitytracker.com/id?1022267","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Novell GroupWise WebAccess Input Validation Flaw in Login Page Permits Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50691","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50691","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271","name":"http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Novell GroupWise WebAccess - Security Vulnerability with Javascript","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=474500","name":"https://bugzilla.novell.com/show_bug.cgi?id=474500","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Access Denied","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1","name":"http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Novell GroupWise WebAccess - Scripting Security Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=484942","name":"https://bugzilla.novell.com/show_bug.cgi?id=484942","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Access Denied","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50689","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50689","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/503885/100/0/threaded","name":"http://www.securityfocus.com/archive/1/503885/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1","name":"http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Novell GroupWise WebAccess - Cross Site Scripting (XSS) Security Vulnerability via Unfiltered Style Expressions","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/35177","name":"http://secunia.com/advisories/35177","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Novell GroupWise Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=472987","name":"https://bugzilla.novell.com/show_bug.cgi?id=472987","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Access Denied","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt","name":"http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://www.securityfocus.com/bid/35066","name":"http://www.securityfocus.com/bid/35066","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Novell GroupWise WebAccess Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50672","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50672","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1635","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1635","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.0","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.0","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.0","cpe7":"sp3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.0.0","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.0.0","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.01","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.02x","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.03","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.03","cpe7":"hp1a","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"7.03","cpe7":"hp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"1635","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"novell","cpe5":"groupwise","cpe6":"8.0","cpe7":"hp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T05:20:34.601Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"groupwise-styleexpressions-xss(50689)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50689"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1"},{"name":"ADV-2009-1393","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/1393"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://bugzilla.novell.com/show_bug.cgi?id=484942"},{"name":"20090528 Novell Groupwise fails to properly sanitize emails.","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/503885/100/0/threaded"},{"name":"35177","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/35177"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://bugzilla.novell.com/show_bug.cgi?id=472987"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271"},{"name":"35061","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/35061"},{"name":"1022267","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1022267"},{"name":"20090521 Novell GroupWise Web Access Multiple XSS","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/503700/100/0/threaded"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://bugzilla.novell.com/show_bug.cgi?id=474500"},{"name":"35066","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/35066"},{"name":"groupwise-webaccess-loginpage-xss(50672)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50672"},{"name":"groupwise-unspecified-xss(50691)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50691"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-05-21T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-10T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"groupwise-styleexpressions-xss(50689)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50689"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1"},{"name":"ADV-2009-1393","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/1393"},{"tags":["x_refsource_MISC"],"url":"https://bugzilla.novell.com/show_bug.cgi?id=484942"},{"name":"20090528 Novell Groupwise fails to properly sanitize emails.","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/503885/100/0/threaded"},{"name":"35177","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/35177"},{"tags":["x_refsource_MISC"],"url":"https://bugzilla.novell.com/show_bug.cgi?id=472987"},{"tags":["x_refsource_MISC"],"url":"http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271"},{"name":"35061","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/35061"},{"name":"1022267","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1022267"},{"name":"20090521 Novell GroupWise Web Access Multiple XSS","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/503700/100/0/threaded"},{"tags":["x_refsource_MISC"],"url":"https://bugzilla.novell.com/show_bug.cgi?id=474500"},{"name":"35066","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/35066"},{"name":"groupwise-webaccess-loginpage-xss(50672)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50672"},{"name":"groupwise-unspecified-xss(50691)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50691"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-1635","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"groupwise-styleexpressions-xss(50689)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50689"},{"name":"http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1","refsource":"CONFIRM","url":"http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1"},{"name":"ADV-2009-1393","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2009/1393"},{"name":"https://bugzilla.novell.com/show_bug.cgi?id=484942","refsource":"MISC","url":"https://bugzilla.novell.com/show_bug.cgi?id=484942"},{"name":"20090528 Novell Groupwise fails to properly sanitize emails.","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/503885/100/0/threaded"},{"name":"35177","refsource":"SECUNIA","url":"http://secunia.com/advisories/35177"},{"name":"https://bugzilla.novell.com/show_bug.cgi?id=472987","refsource":"MISC","url":"https://bugzilla.novell.com/show_bug.cgi?id=472987"},{"name":"http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt","refsource":"MISC","url":"http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt"},{"name":"http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271","refsource":"CONFIRM","url":"http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271"},{"name":"35061","refsource":"BID","url":"http://www.securityfocus.com/bid/35061"},{"name":"1022267","refsource":"SECTRACK","url":"http://securitytracker.com/id?1022267"},{"name":"20090521 Novell GroupWise Web Access Multiple XSS","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/503700/100/0/threaded"},{"name":"https://bugzilla.novell.com/show_bug.cgi?id=474500","refsource":"MISC","url":"https://bugzilla.novell.com/show_bug.cgi?id=474500"},{"name":"35066","refsource":"BID","url":"http://www.securityfocus.com/bid/35066"},{"name":"groupwise-webaccess-loginpage-xss(50672)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50672"},{"name":"groupwise-unspecified-xss(50691)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50691"},{"name":"http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1","refsource":"CONFIRM","url":"http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-1635","datePublished":"2009-05-22T16:25:00.000Z","dateReserved":"2009-05-14T00:00:00.000Z","dateUpdated":"2024-08-07T05:20:34.601Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-05-22 16:48:42","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.0:*:*:*:*:*:*:*","matchCriteriaId":"FE640E9A-762B-4AF4-8677-818CBF16EA4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.0:sp1:*:*:*:*:*:*","matchCriteriaId":"A9FBB457-FDC0-485F-951A-C0A7661A92B0"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.0:sp2:*:*:*:*:*:*","matchCriteriaId":"8661AFFB-5CAF-4D44-A617-E0330C764BDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.0:sp3:*:*:*:*:*:*","matchCriteriaId":"CF66EFEE-DAB2-4455-96F2-50D3E9456485"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.0.0:sp1:*:*:*:*:*:*","matchCriteriaId":"422F4B8A-8133-4DE2-9749-41E3DE0031DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.0.0:sp2:*:*:*:*:*:*","matchCriteriaId":"DD25DC76-F3BE-4A0E-86DC-D27F4948446E"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.0.2:*:*:*:*:*:*:*","matchCriteriaId":"DD0AA3F3-6BE4-4CCC-838F-E8BD1F06590B"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.0.3:*:*:*:*:*:*:*","matchCriteriaId":"0D3BCF9F-9CDA-4DFD-AC39-2624BCFAAD96"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.01:*:*:*:*:*:*:*","matchCriteriaId":"86DB474F-D101-4210-9DC1-7230E9CAE80D"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.02x:*:*:*:*:*:*:*","matchCriteriaId":"D861C5BE-825C-4EED-994A-9DE38AB6EA2A"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.03:*:*:*:*:*:*:*","matchCriteriaId":"1D75C8A8-8162-4160-9295-2DA4D710AD58"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.03:hp1a:*:*:*:*:*:*","matchCriteriaId":"84293DF8-D11D-4CB4-99EC-EB60AF027B8C"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:7.03:hp2:*:*:*:*:*:*","matchCriteriaId":"C4D63B03-C0A1-4366-B853-0D36CA0E6912"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C52E2ABC-20AE-437A-83B0-2E0753787FB5"},{"vulnerable":true,"criteria":"cpe:2.3:a:novell:groupwise:8.0:hp1:*:*:*:*:*:*","matchCriteriaId":"97206FE4-E1F1-40EC-BC01-A0125FB3B20F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"1635","Ordinal":"1","Title":"CVE-2009-1635","CVE":"CVE-2009-1635","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"1635","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.","Type":"Description","Title":"CVE-2009-1635"},{"CveYear":"2009","CveId":"1635","Ordinal":"2","NoteData":"2009-05-22","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"1635","Ordinal":"3","NoteData":"2018-10-10","Type":"Other","Title":"Modified"}]}}}