CVE		CVE-2009-1635
Status		UNKNOWN
Description		Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.
Severity		Medium
CVSS score		4,3
CVSS vector		(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Phase		ASSIGNED (09.06.2009)
NVD:		http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1635
References		BID : 35061
		BID : 35066
		BUGTRAQ : 20090521 Novell GroupWise Web Access Multiple XSS
		BUGTRAQ : 20090528 Novell Groupwise fails to properly sanitize emails.
		CONFIRM : http://www.novell.com/support/search.do?cmd=displa...
		CONFIRM : http://www.novell.com/support/viewContent.do?exter...
		CONFIRM : http://www.novell.com/support/viewContent.do?exter...
		MISC : http://packetstorm.linuxsecurity.com/0905-exploits...
		MISC : https://bugzilla.novell.com/show_bug.cgi?id=472987
		MISC : https://bugzilla.novell.com/show_bug.cgi?id=474500
		MISC : https://bugzilla.novell.com/show_bug.cgi?id=484942
		SECTRACK : 1022267
		SECUNIA : 35177
		VUPEN : ADV-2009-1393
		XF : groupwise-styleexpressions-xss(50689)
		XF : groupwise-unspecified-xss(50691)
		XF : groupwise-webaccess-loginpage-xss(50672)
SecurityVulns:		Novell GroupWise WebAccess crossite scripting
		Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)