Vulnerability Name:

CCN-47484

Published:2008-12-17
Updated:2008-12-17
Summary:Novell Identity Manager is vulnerable to cross-site scripting, caused by improper validation of user-supplied input related to Page Navigation. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Novell Patch Finder Web site
Novell Patch Finder

Source: CCN
Type: SA33228
Novell Identity Manager Cross-Site Scripting Vulnerabilities

Source: CCN
Type: Novell Document ID: 5040000
IDM User Application 301 Field Patch S

Source: CCN
Type: Novell Document ID: 5040020
IDM User Application 350 Field Patch AE

Source: CCN
Type: Novell Document ID: 5040040
IDM User Application 351 Field Patch W

Source: CCN
Type: Novell Document ID: 5040041
IDM Roles Based Provisioning Module 360 Field Patch D

Source: CCN
Type: Novell Document ID: 5040042
IDM Roles Based Provisioning Module 361 Field Patch B

Source: CCN
Type: BID-32924
Novell Identity Manager Multiple Cross Site Scripting Vulnerabilities

Source: XF
Type: UNKNOWN
novell-identity-page-navigation-xss(47484)

Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:novell:identity_manager:3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:novell:identity_manager:3.5:*:*:*:*:*:*:*
  • OR cpe:/a:novell:identity_manager:3.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:novell:identity_manager_roles_based_provisioning_module:3.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:novell:identity_manager_roles_based_provisioning_module:3.6.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    novell identity manager 3.0.1
    novell identity manager 3.5
    novell identity manager 3.5.1
    novell identity manager roles based provisioning module 3.6.0
    novell identity manager roles based provisioning module 3.6.1