Novell GroupWise WebAccess 8.x < 8.0.3 Multiple XSS Vulnerabilities
Medium Nessus Plugin ID 62416
SynopsisThe remote host has an application that is affected by multiple cross-site scripting vulnerabilities.
DescriptionThe version of Novell GroupWise installed on the remote Windows host is earlier than 8.0.3. It is, therefore, reportedly affected by multiple cross-site scripting vulnerabilities :
- The application fails to sanitize user-supplied input to the 'merge' parameter of the 'Search Document' form. (CVE-2012-0272)
- HTML email is not properly sanitized before being displayed to the user. (CVE-2012-4912)
A remote attacker may be able to exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
SolutionUpgrade to GroupWise WebAccess 8.0.3 or later.