PT-2004-3646 · Novell · Novell Ichain

Publicado 2004-12-31 · Atualizado 2017-07-29 · CVE-2004-2757

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Novell iChain versions prior to 2.2 build 2.2.113 Novell iChain version 2.3 First Customer Ship (FCS)

Description A cross-site scripting (XSS) issue exists in the failed login page, allowing remote attackers to inject arbitrary web script or HTML via a url parameter. This could potentially lead to unauthorized actions on the affected system.

Recommendations For Novell iChain versions prior to 2.2 build 2.2.113, update to a version after 2.2 build 2.2.113 to resolve the issue. For Novell iChain version 2.3 First Customer Ship (FCS), consider disabling access to the failed login page until a patch is available. As a temporary workaround, restrict access to the vulnerable url parameter in the failed login page to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2004-2757

Produtos afetados

Novell Ichain

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/14873 · Nota
• http://securityfocus.com/bid/9412 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2757 · Nota de Segurança
• http://secunia.com/advisories/10653 · Aviso do Fabricante
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/10080762.htm · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2757 · Nota