Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Bugtraq ID:	36437
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 16 2009 12:00AM
Updated:	Sep 17 2009 04:20PM
Credit:	Matt Foster, Netcraft
Vulnerable:	Novell Groupwise 7.0 Novell Groupwise 8.0 HP2 Novell Groupwise 8.0 HP1 Novell Groupwise 8.0 Novell Groupwise 7.03HP1a Novell Groupwise 7.03 HP3 Novell Groupwise 7.03 HP2 Novell Groupwise 7.03 Novell Groupwise 7.02x Novell Groupwise 7.01 Novell Groupwise 7.0.0 SP3 Novell Groupwise 7.0.0 SP2 Novell Groupwise 7.0.0 SP1
Not Vulnerable:	Novell Groupwise 8.0 SP1 Novell Groupwise 7.03 HP4

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Novell GroupWise WebAccess is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects the following:

GroupWise 7.0 through 7.03 HP3
GroupWise 8.0 through 8.0.0 HP2

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage.

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

References:

• Novell GroupWise Homepage (Novell)
  
• GroupWise WebAccess - Cross Site Scripting (XSS) Security Vulnerability in User. (Novell)