PT-2004-2999 · Novell · Novell Netware Enterprise Web Server

Published 2004-12-31 · Updated 2018-10-30 · CVE-2004-2103

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Novell NetWare Enterprise Web Server versions 5.1 through 6.0

Description A cross-site scripting issue allows remote attackers to execute arbitrary script or HTML as other users. This can be achieved through various means, including a malformed request for a Perl program with script in the filename, the User.id parameter to the webacc servlet, the GWAP.version parameter to webacc, or a URL request for a .bas file with script in the filename.

Recommendations For Novell NetWare Enterprise Web Server versions 5.1 through 6.0, consider disabling the webacc servlet and restricting access to .bas and Perl files until a patch is available. Avoid using the User.id and GWAP.version parameters in the webacc servlet to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2103

Affected Products

Novell Netware Enterprise Web Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-2103 · Security Note
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/10091529.htm · Note
• http://osvdb.org/4949 · Note
• http://marc.info/?l=bugtraq&m=107487862304440&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14919 · Note