Novell Identity Manager Roles Based Provisioning Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	41337
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 05 2010 12:00AM
Updated:	Jul 05 2010 12:00AM
Credit:	Novell
Vulnerable:	Novell Identity Manager Roles Based Provisioning Module 3.7
Not Vulnerable:

Novell Identity Manager Roles Based Provisioning Multiple Cross Site Scripting Vulnerabilities

Novell Identity Manager Roles Based Provisioning Module is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Novell Identity Manager Roles Based Provisioning Multiple Cross Site Scripting Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting user into following a malicious URI.

Novell Identity Manager Roles Based Provisioning Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available; please see the references for more information.

Novell Identity Manager Roles Based Provisioning Multiple Cross Site Scripting Vulnerabilities

References:

• Novell Identity Manager (Novell)
  
• IDM Roles Based Provisioning Module 370 Field Patch C (Novell)