Novell ZENworks Configuration Management CVE-2013-6344 Cross Frame Scripting Vulnerability

Bugtraq ID:	63497
Class:	Origin Validation Error
CVE:	CVE-2013-6344
Remote:	Yes
Local:	No
Published:	Oct 28 2013 12:00AM
Updated:	Oct 28 2013 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Novell ZENworks Configuration Management 11.2.3 Novell ZENworks Configuration Management 11.2 Novell ZENworks Configuration Management 11.1 Novell ZENworks Configuration Management 11.0
Not Vulnerable:	Novell ZENworks Configuration Management 11.2.4

Novell ZENworks Configuration Management CVE-2013-6344 Cross Frame Scripting Vulnerability

Novell ZENworks Configuration Management is prone to a cross-frame scripting vulnerability.

Successful exploits will allow attackers to bypass the same-origin policy and perform unauthorized actions; other attacks are possible.

Versions prior to Novell ZENworks Configuration Management 11.2.4 are vulnerable.

Novell ZENworks Configuration Management CVE-2013-6344 Cross Frame Scripting Vulnerability

Attackers can exploit this issue by tricking an unsuspecting victim into visiting a malicious web page.

Novell ZENworks Configuration Management CVE-2013-6344 Cross Frame Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Novell ZENworks Configuration Management CVE-2013-6344 Cross Frame Scripting Vulnerability

References:

• ZENworks Configuration Management 11.2.4 - update information and list of fixes (Novell)
  
• ZENworks Configuration Management Homepage (Novell)