Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Bugtraq ID:	41711
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 30 2010 12:00AM
Updated:	Jun 30 2010 12:00AM
Credit:	scriptjunkie
Vulnerable:	Novell GroupWise WebAccess 6.5 SP2 + Novell Groupwise 6.5 SP1 + Novell Groupwise 6.5 Novell GroupWise WebAccess 6.5 SP1 + Novell Groupwise 6.5 SP1 + Novell Groupwise 6.5 Novell GroupWise WebAccess 6.5 Novell GroupWise WebAccess 6.0 SP4 Novell Groupwise 7.0 Novell Groupwise 8.01x Novell Groupwise 8.0 Novell Groupwise 7.04 Novell Groupwise 7.03x Novell Groupwise 7.02 Novell Groupwise 7.01
Not Vulnerable:	Novell Groupwise 8.0 SP2 Novell Groupwise 7.0 SP4

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Novell GroupWise WebAccess is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

GroupWise 7.0, 7.01, 7.02, 7.03x, 8.0 and 8.01x are vulnerable; other versions may also be affected.

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to visit a malicious page.

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

References:

• Novell GroupWise Homepage (Novell)
  
• GroupWise WebAccess Javascript Cross-Site Scripting (XSS) Security Vulnerability (Novell)