Novell GroupWise CVE-2012-4912 HTML Injection Vulnerability

Bugtraq ID:	55814
Class:	Input Validation Error
CVE:	CVE-2012-4912
Remote:	Yes
Local:	No
Published:	Oct 05 2012 12:00AM
Updated:	Oct 05 2012 12:00AM
Credit:	Joshua Tiago, Cirosec via Secunia
Vulnerable:	Novell GroupWise 8.0 Support Pack 2 0 Novell Groupwise 2012 0 Novell Groupwise 8.02 HP3 Novell Groupwise 8.02 HP2 Novell Groupwise 8.02 HP1 Novell Groupwise 8.02 Novell Groupwise 8.0 SP1 Novell Groupwise 8.0 HP3 Novell Groupwise 8.0 HP2 Novell Groupwise 8.0 HP1 Novell Groupwise 8.0
Not Vulnerable:

Novell GroupWise CVE-2012-4912 HTML Injection Vulnerability

Novell GroupWise is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

Novell GroupWise CVE-2012-4912 HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Novell GroupWise CVE-2012-4912 HTML Injection Vulnerability

Solution:
Updates are available. Please see the references for more information.

Novell GroupWise CVE-2012-4912 HTML Injection Vulnerability

References:

• Novell GroupWise Homepage (Novell)