CVE-2005-2276 - Cross-site scripting (XSS) vulnerability in Novell Groupwise WebAccess 6.5 before July 11, 2005 allo

CVE-2005-2276

Summary

Cross-site scripting (XSS) vulnerability in Novell Groupwise WebAccess 6.5 before July 11, 2005 allows remote attackers to inject arbitrary web script or HTML via an e-mail message with an encoded javascript URI (e.g. "j&#X41vascript" in an IMG tag.

References

Vulnerable Configurations

cpe:2.3:a:novell:groupwise_webaccess:6.0:sp4:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.0:sp4:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.5:*:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.5:*:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.5:sp1:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.5:sp1:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.5:sp2:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.5:sp2:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.5:sp3:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.5:sp3:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.5:sp4:*:*:*:*:*:*
cpe:2.3:a:novell:groupwise_webaccess:6.5:sp4:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 11-07-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	14310
bugtraq	20050719 [ISR] - Novell Groupwise WebAccess Cross-Site Scripting
confirm	http://support.novell.com/cgi-bin/search/searchtid.cgi?/10098301.htm
misc	http://www.infobyte.com.ar/adv/ISR-11.html
osvdb	18064
sectrack	1014515
secunia	16098
xf	novell-groupwise-webaccess-xss(21421)

Last major update

11-07-2017 - 01:32

Published

26-07-2005 - 04:00

Last modified

11-07-2017 - 01:32