Vulnerability CVE-2011-1696 - CERT Civis.Net

Vulnerability Name:

CVE-2011-1696 (CCN-70291)

Assigned:

2011-09-27

Published:

2011-09-27

Updated:

2011-11-22

Summary:

Cross-site scripting (XSS) vulnerability in Novell Identity Manager (aka IDM) User Application 3.5.0, 3.5.1, 3.6.0, 3.6.1, 3.7.0, and 4.0.0, and Identity Manager Roles Based Provisioning Module 3.6.0, 3.6.1, 3.7.0, and 4.0.0, allows remote attackers to inject arbitrary web script or HTML via the apwaDetail (aka apwaDetailId) parameter, aka Bug 692972.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2011-1696

Source: CCN
Type: SA46268
Novell Identity Manager Cross-Site Scripting Vulnerabilities

Source: CONFIRM
Type: UNKNOWN
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5111710.html

Source: CCN
Type: Novell Document ID: 5111711
IDM Roles Based Provisioning Module 370 Field Patch E

Source: CONFIRM
Type: UNKNOWN
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5111711.html

Source: CONFIRM
Type: UNKNOWN
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5112230.html

Source: CONFIRM
Type: UNKNOWN
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5112250.html

Source: CONFIRM
Type: UNKNOWN
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5112270.html

Source: CONFIRM
Type: UNKNOWN
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5112271.html

Source: CCN
Type: OSVDB ID: 76019
Novell Identity Manager apwaDetailId Parameter Unspecified XSS (2011-1696)

Source: BID
Type: UNKNOWN
49935

Source: CCN
Type: BID-49935
Novell Identity Manager 'apwaDetail' Multiple Cross Site Scripting Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1026138

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.novell.com/show_bug.cgi?id=692972

Source: XF
Type: UNKNOWN
novell-apwadetailid-xss(70291)

Vulnerable Configuration:

Configuration 1:

cpe:/a:novell:identity_manager_roles_based_provisioning_module:3.6.0:*:*:*:*:*:*:*

OR cpe:/a:novell:identity_manager_roles_based_provisioning_module:3.6.1:*:*:*:*:*:*:*

OR cpe:/a:novell:identity_manager_roles_based_provisioning_module:3.7.0:*:*:*:*:*:*:*

OR cpe:/a:novell:identity_manager_roles_based_provisioning_module:4.0.0:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:novell:identity_manager_user_application:3.5.0:*:*:*:*:*:*:*

OR cpe:/a:novell:identity_manager_user_application:3.5.1:*:*:*:*:*:*:*

OR cpe:/a:novell:identity_manager_user_application:3.6.0:*:*:*:*:*:*:*

OR cpe:/a:novell:identity_manager_user_application:3.6.1:*:*:*:*:*:*:*

OR cpe:/a:novell:identity_manager_user_application:3.7.0:*:*:*:*:*:*:*

OR cpe:/a:novell:identity_manager_user_application:4.0.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:novell:identity_manager_roles_based_provisioning_module:3.7.0:*:*:*:*:*:*:*

Denotes that component is vulnerable