PT-2007-3911 · Novell+1 · Novell Groupwise Mobile Server+2
Published
2007-05-11
·
Updated
2018-10-16
·
CVE-2007-2592
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Nokia Intellisync Mobile Suite versions 6.4.31.2, 6.6.0.107, 6.6.2.2
Description
The issue involves multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This is possibly related to Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express. The
username parameter to the "de/pda/dev logon.asp" endpoint is vulnerable, as well as multiple unspecified vectors in files such as "usrmgr/registerAccount.asp" and "de/create account.asp".Recommendations
For Nokia Intellisync Mobile Suite version 6.4.31.2, avoid using the
username parameter in the "de/pda/dev logon.asp" endpoint until the issue is resolved.
For Nokia Intellisync Mobile Suite version 6.6.0.107, restrict access to the "usrmgr/registerAccount.asp" and "de/create account.asp" files to minimize the risk of exploitation.
For Nokia Intellisync Mobile Suite version 6.6.2.2, consider disabling the affected endpoints until a patch is available.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Nokia Intellisync Mobile Suite
Nokia Intellisync Wireless Email Express
Novell Groupwise Mobile Server