PT-2006-4676 · Novell · Novell Groupwise Webaccess

Published 2006-08-11 · Updated 2018-10-17 · CVE-2006-3817

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Novell GroupWise WebAccess versions prior to 20060727

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via an encoded SCRIPT element in an e-mail message using the UTF-7 character set. This can be achieved with a specific sequence, such as "+ADw-SCRIPT+AD4-".

Recommendations For Novell GroupWise WebAccess versions prior to 20060727, update to a version released after 20060727 to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2006-3817

Affected Products

Novell Groupwise Webaccess

References · 11

• 🔥 http://infobyte.com.ar/adv/ISR-14.html · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048593.html · Exploit
• 🔥 http://secunia.com/advisories/21411 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3817 · Security Note
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974176.htm · Patch
• http://novell.com/support/search.do?cmd=displayKC&externalId=3701584&sliceId=SAL_Public · Patch
• http://securitytracker.com/id?1016648 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28211 · Note
• http://securityfocus.com/bid/19297 · Note
• http://securityfocus.com/archive/1/442719/100/100/threaded · Note
• http://vupen.com/english/advisories/2006/3098 · Note