PT-2007-1595 · Novell · Novell Access Manager Identity Server

Publicado 2007-01-09 · Atualizado 2011-03-08 · CVE-2007-0110

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Novell Access Manager Identity Server versions prior to 3.0.0-1013

Description A cross-site scripting (XSS) issue exists due to improper handling of the IssueInstant parameter in the nidp/idff/sso component, allowing remote attackers to inject arbitrary web script or HTML via this parameter. This can occur when the parameter is not properly handled in the resulting error message.

Recommendations For versions prior to 3.0.0-1013, update to version 3.0.0-1013 or later to resolve the issue. As a temporary workaround, consider restricting access to the nidp/idff/sso component to minimize the risk of exploitation. Avoid using the IssueInstant parameter in the affected component until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-0110

Produtos afetados

Novell Access Manager Identity Server

Referências · 8

• 🔥 https://exploit-db.com/exploits/29400 · Exploit
• https://secure-support.novell.com/KanisaPlatform/Publishing/143/3615264_f.SAL_Public.html · Aviso do Fabricante
• http://securityfocus.com/bid/21921 · Nota
• http://securitytracker.com/id?1017483 · Nota
• http://secunia.com/advisories/23654 · Nota
• http://vupen.com/english/advisories/2007/0073 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0110 · Nota de Segurança
• http://osvdb.org/31359 · Nota