CVE-2007-0110 - Cross-site scripting (XSS) vulnerability in nidp/idff/sso in Novell Access Manager Identity Server b

CVE-2007-0110

Summary

Cross-site scripting (XSS) vulnerability in nidp/idff/sso in Novell Access Manager Identity Server before 3.0.0-1013 allows remote attackers to inject arbitrary web script or HTML via the IssueInstant parameter, which is not properly handled in the resulting error message.

References

Vulnerable Configurations

cpe:2.3:a:novell:access_manager_identity_server:-:*:*:*:*:*:*:*
cpe:2.3:a:novell:access_manager_identity_server:-:*:*:*:*:*:*:*
cpe:2.3:a:novell:access_manager_identity_server:3:*:*:*:*:*:*:*
cpe:2.3:a:novell:access_manager_identity_server:3:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 08-03-2011 - 02:48)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bid	21921
confirm	https://secure-support.novell.com/KanisaPlatform/Publishing/143/3615264_f.SAL_Public.html
osvdb	31359
sectrack	1017483
secunia	23654
vupen	ADV-2007-0073

Last major update

08-03-2011 - 02:48

Published

09-01-2007 - 00:28

Last modified

08-03-2011 - 02:48