CVE-2009-1635

Published: May 22, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.

Affected (15)

Products: Novell: Groupwise

1 product

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Novell Groupwise	Version 7.0.0 sp1
Novell Groupwise	Version 7.0.0 sp2
Novell Groupwise	Version 7.0.2
Novell Groupwise	Version 7.0.3
Novell Groupwise	Version 7.01
Novell Groupwise	Version 7.02x
Novell Groupwise	Version 7.03
Novell Groupwise	Version 7.03 hp1a
Novell Groupwise	Version 7.03 hp2
Novell Groupwise	Version 7.0
Novell Groupwise	Version 7.0 sp1
Novell Groupwise	Version 7.0 sp2
Novell Groupwise	Version 7.0 sp3
Novell Groupwise	Version 8.0
Novell Groupwise	Version 8.0 hp1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (34)

http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt

Source: cve@mitre.org

http://secunia.com/advisories/35177

Source: cve@mitre.org

http://securitytracker.com/id?1022267

Source: cve@mitre.org

http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271

Source: cve@mitre.org

PatchVendor Advisory

http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1

Source: cve@mitre.org

http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/503700/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/503885/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/35061

Source: cve@mitre.org

http://www.securityfocus.com/bid/35066

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1393

Source: cve@mitre.org

https://bugzilla.novell.com/show_bug.cgi?id=472987

Source: cve@mitre.org

https://bugzilla.novell.com/show_bug.cgi?id=474500

Source: cve@mitre.org

https://bugzilla.novell.com/show_bug.cgi?id=484942

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/50672

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/50689

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/50691

Source: cve@mitre.org

http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/35177

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1022267

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/503700/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/503885/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/35061

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/35066

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/1393

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.novell.com/show_bug.cgi?id=472987

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.novell.com/show_bug.cgi?id=474500

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.novell.com/show_bug.cgi?id=484942

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/50672

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/50689

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/50691

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.