CVE-2009-1635

Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.
References
Link Resource
http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt
http://secunia.com/advisories/35177
http://securitytracker.com/id?1022267
http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271 Patch Vendor Advisory
http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1
http://www.securityfocus.com/archive/1/503700/100/0/threaded
http://www.securityfocus.com/archive/1/503885/100/0/threaded
http://www.securityfocus.com/bid/35061
http://www.securityfocus.com/bid/35066
http://www.vupen.com/english/advisories/2009/1393
https://bugzilla.novell.com/show_bug.cgi?id=472987
https://bugzilla.novell.com/show_bug.cgi?id=474500
https://bugzilla.novell.com/show_bug.cgi?id=484942
https://exchange.xforce.ibmcloud.com/vulnerabilities/50672
https://exchange.xforce.ibmcloud.com/vulnerabilities/50689
https://exchange.xforce.ibmcloud.com/vulnerabilities/50691
http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt
http://secunia.com/advisories/35177
http://securitytracker.com/id?1022267
http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271 Patch Vendor Advisory
http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1
http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1
http://www.securityfocus.com/archive/1/503700/100/0/threaded
http://www.securityfocus.com/archive/1/503885/100/0/threaded
http://www.securityfocus.com/bid/35061
http://www.securityfocus.com/bid/35066
http://www.vupen.com/english/advisories/2009/1393
https://bugzilla.novell.com/show_bug.cgi?id=472987
https://bugzilla.novell.com/show_bug.cgi?id=474500
https://bugzilla.novell.com/show_bug.cgi?id=484942
https://exchange.xforce.ibmcloud.com/vulnerabilities/50672
https://exchange.xforce.ibmcloud.com/vulnerabilities/50689
https://exchange.xforce.ibmcloud.com/vulnerabilities/50691
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:novell:groupwise:7.0:*:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.0:sp1:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.0:sp2:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.0:sp3:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.0.0:sp1:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.0.0:sp2:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.01:*:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.02x:*:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.03:*:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.03:hp1a:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:7.03:hp2:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:8.0:*:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise:8.0:hp1:*:*:*:*:*:*

History

21 Nov 2024, 01:02

Type Values Removed Values Added
References () http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt - () http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt -
References () http://secunia.com/advisories/35177 - () http://secunia.com/advisories/35177 -
References () http://securitytracker.com/id?1022267 - () http://securitytracker.com/id?1022267 -
References () http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271 - Patch, Vendor Advisory () http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271 - Patch, Vendor Advisory
References () http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1 - () http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1 -
References () http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1 - () http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1 -
References () http://www.securityfocus.com/archive/1/503700/100/0/threaded - () http://www.securityfocus.com/archive/1/503700/100/0/threaded -
References () http://www.securityfocus.com/archive/1/503885/100/0/threaded - () http://www.securityfocus.com/archive/1/503885/100/0/threaded -
References () http://www.securityfocus.com/bid/35061 - () http://www.securityfocus.com/bid/35061 -
References () http://www.securityfocus.com/bid/35066 - () http://www.securityfocus.com/bid/35066 -
References () http://www.vupen.com/english/advisories/2009/1393 - () http://www.vupen.com/english/advisories/2009/1393 -
References () https://bugzilla.novell.com/show_bug.cgi?id=472987 - () https://bugzilla.novell.com/show_bug.cgi?id=472987 -
References () https://bugzilla.novell.com/show_bug.cgi?id=474500 - () https://bugzilla.novell.com/show_bug.cgi?id=474500 -
References () https://bugzilla.novell.com/show_bug.cgi?id=484942 - () https://bugzilla.novell.com/show_bug.cgi?id=484942 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/50672 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/50672 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/50689 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/50689 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/50691 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/50691 -

Information

Published : 2009-05-22 16:48

Updated : 2024-11-21 01:02


NVD link : CVE-2009-1635

Mitre link : CVE-2009-1635

CVE.ORG link : CVE-2009-1635


JSON object : View

Products Affected

novell

  • groupwise
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')