Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Bugtraq ID:	41714
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 30 2010 12:00AM
Updated:	Jun 30 2010 12:00AM
Credit:	scriptjunkie
Vulnerable:	Novell Groupwise 8.01x Novell Groupwise 8.0
Not Vulnerable:	Novell Groupwise 8.0 SP2

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Novell GroupWise WebAccess is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

GroupWise 8.0 and Groupwise 8.01x are vulnerable; other versions may also be affected.

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to visit a malicious page.

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Novell GroupWise WebAccess Cross-Site Scripting Vulnerability

References:

• GroupWise WebAccess Cross-Site Scripting (XSS) Security Vulnerability on Replies (Novell)
  
• Novell GroupWise Homepage (Novell)