Unscored severity · published May 22, 2009
CVE-2009-1635
Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Groupwise · Novell
7.0; 7.0; 7.0; 7.0; 7.0.0; 7.0.0; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1635
packetstorm.linuxsecurity.com
http://packetstorm.linuxsecurity.com/0905-exploits/groupwise-xss.txt
secunia.com
http://secunia.com/advisories/35177
securitytracker.com
http://securitytracker.com/id?1022267
Patch
http://www.novell.com/support/search.do?cmd=displayKC&externalId=7003271
www.novell.com
http://www.novell.com/support/viewContent.do?externalId=7003267&sliceId=1
www.novell.com
http://www.novell.com/support/viewContent.do?externalId=7003268&sliceId=1
More from Groupwise
9.8
CVE-2016-5762
Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code via a long (1)…
6.1
CVE-2016-5761
Cross-site scripting (XSS) vulnerability in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allows remote attackers to inject arbitrary web script or HTML via a crafted…
6.1
CVE-2016-5760
Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote attackers to inject…
6.1
CVE-2016-9169
A reflected XSS vulnerability exists in the web console of the Document Viewer Agent in Novell GroupWise before 2014 R2 Support Pack 1 Hot Patch 2 that may enable a remote…
–
CVE-2014-0611
Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 2012 before Support Pack 4 and 2014 before Support Pack 2 allow remote attackers to inject…