CVE-2009-1762: XSS

Published May 22, 2009

Updated

Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess login page (aka gw/webacc) in Novell GroupWise 7.x before 7.03 HP2 allow remote attackers to inject arbitrary web script or HTML via the (1) GWAP.version or (2) User.Theme (aka User.Theme.index) parameter.

Affected Software

13 affected components

Novell GroupWise=7.0

Novell GroupWise=7.0-sp1

Novell GroupWise=7.0-sp2

Novell GroupWise=7.0-sp3

Novell GroupWise=7.0.0-sp1

Novell GroupWise=7.0.0-sp2

Novell GroupWise=7.0.2

Novell GroupWise=7.0.3

Novell GroupWise=7.01

Novell GroupWise=7.02x

Novell GroupWise=7.03

Novell GroupWise=7.03-hp1a

Novell GroupWise=7.03-hp2

Remediation

Patch Available

http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271

Event History

May 22, 2009

CVE Published

via MITRE·04:25 PM

Data Sourced

via MITRE·04:25 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1762?

CVE-2009-1762 has a moderate severity level due to its potential for cross-site scripting attacks.

How do I fix CVE-2009-1762?

To fix CVE-2009-1762, you should upgrade to Novell GroupWise version 7.0.3 HP2 or later.

What types of attacks are possible with CVE-2009-1762?

CVE-2009-1762 allows attackers to perform cross-site scripting attacks via the GWAP.version or User.Theme parameters.

Which versions of Novell GroupWise are affected by CVE-2009-1762?

CVE-2009-1762 affects Novell GroupWise versions prior to 7.03 HP2, including versions 7.0 and 7.0.2.

Can CVE-2009-1762 lead to data theft?

Yes, CVE-2009-1762 can potentially lead to data theft by allowing attackers to execute malicious scripts in the user's browser.