Vulnerability CVE-2013-1086 - CERT Civis.Net

Vulnerability Name:

CVE-2013-1086 (CCN-83620)

Assigned:

2013-04-16

Published:

2013-04-16

Updated:

2017-09-02

Summary:

Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise before 8.0.3 HP3, and 2012 before SP2, allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError attribute.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2013-1086

Source: CCN
Type: SA53098
Novell GroupWise WebAccess "OnError" Cross-Site Scripting Vulnerability

Source: SECUNIA
Type: Permissions Required
53098

Source: CCN
Type: Novell Document ID 7012064
GroupWise WebAccess Cross-site Scripting (XSS) Vulnerability in "OnError" Parameter

Source: CONFIRM
Type: Third Party Advisory, Vendor Advisory
http://www.novell.com/support/kb/doc.php?id=7012064

Source: CCN
Type: BID-59268
Novell GroupWise WebAccess 'onError' Attribute Cross-Site Scripting Vulnerability

Source: CONFIRM
Type: Issue Tracking
https://bugzilla.novell.com/show_bug.cgi?id=802906

Source: XF
Type: UNKNOWN
groupwise-onerror-xss(83620)

Vulnerable Configuration:

Configuration 1:

cpe:/a:novell:groupwise:2012:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:2012:sp1:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:2012:sp1_hp1:*:*:*:*:*:*

Configuration 2:

cpe:/a:novell:groupwise:5.2:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:5.5:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:5.57e:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.0:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.0.1:sp1:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5:sp1:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5:sp2:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5:sp3:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5:sp4:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5:sp5:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5:sp6:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5.2:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5.3:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5.4:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5.6:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:6.5.7:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.0:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.0.3:hp4:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.0.3:hp5:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.0.4:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.0.4:ftf:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.01:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.01:ir1:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.02:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.02:hp1:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.02:hp1a:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.02:hp2:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.02:hp2r1:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.03:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.03:hp:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.03:hp2:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.03:hp3:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:7.03:hp3+ftf:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.0:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.00:hp1:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.00:hp2:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.00:hp3:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.01:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.01:hp:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.02:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.02:hp1:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.02:hp2:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.02:hp3:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.03:*:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:8.03:hp1:*:*:*:*:*:*

OR cpe:/a:novell:groupwise:*:hp2:*:*:*:*:*:* (Version <= 8.03)

Configuration CCN 1:

cpe:/a:novell:groupwise:8.03:hp2:*:*:*:*:*:*

Denotes that component is vulnerable