PT-2007-6689 · Novell · Novell Opensuse Swamp Workflow Administration/Management Platform

Publicado 2007-10-29 · Atualizado 2018-10-15 · CVE-2007-5702

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Novell OpenSUSE SWAMP Workflow Administration and Management Platform version 1.x

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the username parameter in the login box, which is part of the swamp/action/LoginActions in the platform.

Recommendations For Novell OpenSUSE SWAMP Workflow Administration and Management Platform version 1.x, avoid using the username parameter in the login box until the issue is resolved. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5702

Produtos afetados

Novell Opensuse Swamp Workflow Administration/Management Platform

Referências · 7

• http://swamp.svn.sourceforge.net/viewvc/swamp/trunk/swamp/webapps/webswamp/src/java/de/suse/swamp/modules/actions/LoginActions.java?r1=666&r2=700 · Nota
• http://securityfocus.com/bid/26198 · Nota
• http://securityfocus.com/archive/1/482733/100/0/threaded · Nota
• http://osvdb.org/38203 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5702 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37399 · Nota
• http://secunia.com/advisories/27390 · Aviso do Fabricante