Novell GroupWise WebAccess 'gw/webacc' Multiple Cross-Site Scripting Vulnerabilities
BID:35061
Info
Novell GroupWise WebAccess 'gw/webacc' Multiple Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 35061 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-1635 |
| Remote: | Yes |
| Local: | No |
| Published: | May 21 2009 12:00AM |
| Updated: | May 21 2009 06:40PM |
| Credit: | Scott White, Secure State |
| Vulnerable: |
Novell Groupwise 7.0 Novell Groupwise 8.0 HP1 Novell Groupwise 8.0 Novell Groupwise 7.03HP1a Novell Groupwise 7.03 HP2 Novell Groupwise 7.03 Novell Groupwise 7.02x Novell Groupwise 7.01 Novell Groupwise 7.0.0 SP3 Novell Groupwise 7.0.0 SP2 Novell Groupwise 7.0.0 SP1 |
| Not Vulnerable: |
Novell Groupwise 8.0 HP2 Novell Groupwise 7.03 HP3 |
Discussion
Novell GroupWise WebAccess 'gw/webacc' Multiple Cross-Site Scripting Vulnerabilities
Novell GroupWise WebAccess is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Novell GroupWise WebAccess is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Exploit / POC
Novell GroupWise WebAccess 'gw/webacc' Multiple Cross-Site Scripting Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting user to view a malicious webpage.
To exploit these issues, an attacker must entice an unsuspecting user to view a malicious webpage.
Solution / Fix
Novell GroupWise WebAccess 'gw/webacc' Multiple Cross-Site Scripting Vulnerabilities
Solution:
The vendor has released updates. Please contact the vendor for details.
Solution:
The vendor has released updates. Please contact the vendor for details.
References
Novell GroupWise WebAccess 'gw/webacc' Multiple Cross-Site Scripting Vulnerabilities
References:
References: