PT-2004-3646 · Novell · Novell Ichain

Published 2004-12-31 · Updated 2017-07-29 · CVE-2004-2757

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Novell iChain versions prior to 2.2 build 2.2.113 Novell iChain version 2.3 First Customer Ship (FCS)

Description A cross-site scripting (XSS) issue exists in the failed login page, allowing remote attackers to inject arbitrary web script or HTML via a url parameter. This could potentially lead to unauthorized actions on the affected system.

Recommendations For Novell iChain versions prior to 2.2 build 2.2.113, update to a version after 2.2 build 2.2.113 to resolve the issue. For Novell iChain version 2.3 First Customer Ship (FCS), consider disabling access to the failed login page until a patch is available. As a temporary workaround, restrict access to the vulnerable url parameter in the failed login page to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2004-2757

Affected Products

Novell Ichain

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-2757 · Security Note
• http://secunia.com/advisories/10653 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14873 · Note
• http://securityfocus.com/bid/9412 · Note
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/10080762.htm · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2757 · Note