Novell GroupWise WebAccess 8.x < 8.0.3 Multiple XSS Vulnerabilities

Medium Nessus Plugin ID 62416


The remote host has an application that is affected by multiple cross-site scripting vulnerabilities.


The version of Novell GroupWise installed on the remote Windows host is earlier than 8.0.3. It is, therefore, reportedly affected by multiple cross-site scripting vulnerabilities :

- The application fails to sanitize user-supplied input to the 'merge' parameter of the 'Search Document' form. (CVE-2012-0272)

- HTML email is not properly sanitized before being displayed to the user. (CVE-2012-4912)

A remote attacker may be able to exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.


Upgrade to GroupWise WebAccess 8.0.3 or later.

See Also

Plugin Details

Severity: Medium

ID: 62416

File Name: groupwise_webaccess_803.nasl

Version: 1.8

Type: local

Agent: windows

Family: Windows

Published: 2012/10/03

Updated: 2018/11/15

Dependencies: 62415, 10456

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:novell:groupwise_webaccess

Required KB Items: SMB/GroupWise WebAccess/Version

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2012/09/14

Vulnerability Publication Date: 2012/07/03

Reference Information

CVE: CVE-2012-0272, CVE-2012-4912

BID: 55633, 55814

CWE: 20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990