SECUNIA ADVISORY ID: SA40491 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/40491/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=40491 RELEASE DATE: 2010-07-05 DISCUSS ADVISORY: http://secunia.com/advisories/40491/#comments DESCRIPTION: Some vulnerabilities have been reported in Novell Identity Manager, which can be exploited by malicious people to conduct cross-site scripting attacks. 1) Input passed to ForgotPassword.jsp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 2) Input passed via unspecified parameters to forgotUser.do is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 3) Input passed via unspecified parameters to an unspecified Portlet is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerabilities are reported in Identity Manager Roles Based Provisioning Module 3.7.0 (User Application 3.7.0) prior to Field Patch 370C. SOLUTION: Apply Field Patch 370C. Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5077230.html

What's Related http://secunia.com/advi... https://ca.secunia.com/... http://secunia.com/advi... http://secunia.com/prod... http://support.novell.c... More by kkbass More from Security

Story Options Mail Story to a Friend Printable Story Format

Trackback

Trackback URL for this entry: http://www.abend.org/trackback.php/20100705175418852

http://topsy.com/www.abend.org/article.php/20100705175418852?utm_source=pingback&utm_campaign=L2
Tracked on Monday, July 05 2010 @ 06:52 PM CDT

Financial Report Says That Novell “Continues to Disappointâ€� and Novell Still Wants to ‘Own’ OpenOffice.o
Tracked on Thursday, July 08 2010 @ 06:11 AM CDT

[SA40491] Novell Identity Manager Cross-Site Scripting Vulnerabilities | 0 comments | Create New Account

Newest First Oldest First Flat Nested No Comments Threaded

The following comments are owned by whomever posted them. This site is not responsible for what they say.