Novell Identity Manager 'apwaDetail' Multiple Cross Site Scripting Vulnerabilities
BID:49935
Info
Novell Identity Manager 'apwaDetail' Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 49935 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-1696 CVE-2011-2227 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 04 2011 12:00AM |
| Updated: | Oct 05 2011 04:40PM |
| Credit: | Novell |
| Vulnerable: |
Novell Identity Manager Roles Based Provisioning Module 3.7 Novell Identity Manager Roles Based Provisioning Module 3.5.1 Novell Identity Manager Roles Based Provisioning Module 4.0 Novell Identity Manager 3.7 |
| Not Vulnerable: | |
Discussion
Novell Identity Manager 'apwaDetail' Multiple Cross Site Scripting Vulnerabilities
Novell Identity Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
IDM Roles Based Provisioning Module 3.5.1 (field patch 351V, 351W, 351X, 351Z, 351AA), 3.7.0 (prior to field patch 370E) and 4.0 (field patch 400A and 400B) are vulnerable.
Novell Identity Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
IDM Roles Based Provisioning Module 3.5.1 (field patch 351V, 351W, 351X, 351Z, 351AA), 3.7.0 (prior to field patch 370E) and 4.0 (field patch 400A and 400B) are vulnerable.
Exploit / POC
Novell Identity Manager 'apwaDetail' Multiple Cross Site Scripting Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
Novell Identity Manager 'apwaDetail' Multiple Cross Site Scripting Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
Novell Identity Manager 'apwaDetail' Multiple Cross Site Scripting Vulnerabilities
References:
References: