PT-2007-3911 · Novell+1 · Novell Groupwise Mobile Server+2
Publicado
2007-05-11
·
Atualizado
2018-10-16
·
CVE-2007-2592
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Nokia Intellisync Mobile Suite versions 6.4.31.2, 6.6.0.107, 6.6.2.2
Description
The issue involves multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This is possibly related to Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express. The
username parameter to the "de/pda/dev logon.asp" endpoint is vulnerable, as well as multiple unspecified vectors in files such as "usrmgr/registerAccount.asp" and "de/create account.asp".Recommendations
For Nokia Intellisync Mobile Suite version 6.4.31.2, avoid using the
username parameter in the "de/pda/dev logon.asp" endpoint until the issue is resolved.
For Nokia Intellisync Mobile Suite version 6.6.0.107, restrict access to the "usrmgr/registerAccount.asp" and "de/create account.asp" files to minimize the risk of exploitation.
For Nokia Intellisync Mobile Suite version 6.6.2.2, consider disabling the affected endpoints until a patch is available.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Nokia Intellisync Mobile Suite
Nokia Intellisync Wireless Email Express
Novell Groupwise Mobile Server