CVE-2016-5760

6.1MEDIUM

Key Information:

Vendor: Novell
Status: Groupwise
Vendor: CVE Published:; 20 April 2017

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote attackers to inject arbitrary web script or HTML via the (1) token parameter to gwadmin-console/install/login.jsp or (2) PATH_INFO to gwadmin-console/index.jsp.

References

http://packetstormsecurity.com/files/138503/Micro-Focus-G...

x_refsource_MISC

http://www.securityfocus.com/archive/1/539296/100/0/threaded

mailing-listx_refsource_BUGTRAQ

http://www.securityfocus.com/bid/92646

vdb-entryx_refsource_BID

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Apr 20, 2017
Vulnerability Reserved
Jun 23, 2016

Collectors

NVD DatabaseMitre Database

.