PT-2007-6269 · Grouplink · Grouplink Ehelpdesk

Published 2007-10-03 · Updated 2017-07-29 · CVE-2007-5176

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GroupLink eHelpDesk version 6.2.2

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the NA DISPLAYNAME parameter in "helpdesk/user/rf create.jsp", and the username and LDAPError parameters in "index2.jsp".

Recommendations For version 6.2.2, consider restricting access to the vulnerable parameters NA DISPLAYNAME, username, and LDAPError in the respective API endpoints until a patch is available. As a temporary workaround, avoid using these parameters in "helpdesk/user/rf create.jsp" and "index2.jsp" to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-5176

Affected Products

Grouplink Ehelpdesk

References · 7

• http://secunia.com/advisories/26892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5176 · Security Note
• http://osvdb.org/37536 · Note
• http://securityfocus.com/bid/25870 · Note
• http://osvdb.org/37535 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36885 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36886 · Note