PT-2007-6689 · Novell · Novell Opensuse Swamp Workflow Administration/Management Platform

Published 2007-10-29 · Updated 2018-10-15 · CVE-2007-5702

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Novell OpenSUSE SWAMP Workflow Administration and Management Platform version 1.x

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the username parameter in the login box, which is part of the swamp/action/LoginActions in the platform.

Recommendations For Novell OpenSUSE SWAMP Workflow Administration and Management Platform version 1.x, avoid using the username parameter in the login box until the issue is resolved. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-5702

Affected Products

Novell Opensuse Swamp Workflow Administration/Management Platform

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-5702 · Security Note
• http://secunia.com/advisories/27390 · Vendor Advisory
• http://swamp.svn.sourceforge.net/viewvc/swamp/trunk/swamp/webapps/webswamp/src/java/de/suse/swamp/modules/actions/LoginActions.java?r1=666&r2=700 · Note
• http://securityfocus.com/bid/26198 · Note
• http://securityfocus.com/archive/1/482733/100/0/threaded · Note
• http://osvdb.org/38203 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37399 · Note