MoreGroupWare Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	8041
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 26 2003 12:00AM
Updated:	Jun 26 2003 12:00AM
Credit:	Discovery of this vulnerability credited to <[email protected]>.
Vulnerable:	moregroupware moregroupware 0.6.7
Not Vulnerable:

MoreGroupWare Multiple Cross-Site Scripting Vulnerabilities

Several cross-site scripting vulnerabilities have been reported for moregroupware. The vulnerability exists due to insufficient sanitization of user-supplied data.

An attacker could exploit these issues by enticing a web user to a malicious link which contains hostile HTML or script code.

Exploitation could permit an attacker to steal cookie-based authentication credentials or launch other attacks.

MoreGroupWare Multiple Cross-Site Scripting Vulnerabilities

There is no exploit code required.

MoreGroupWare Multiple Cross-Site Scripting Vulnerabilities

Solution:
The vendor has stated that a new version of moregroupware will be available in the near future.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MoreGroupWare Multiple Cross-Site Scripting Vulnerabilities

References:

• moregroupware (moregroupware)
  
• [KSA-002] Multiple Vulnerabilities In Moregroupware ()