CVE-2008-0925

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the iMonitor interface of Novell eDirectory versions 8.7.3.x before 8.7.3 sp10, and 8.8.x before 8.8.2 ftf2. The flaw resides in how the HTTP stack generates error messages; unspecified parameters passed to the iMonitor component are not properly sanitized before being included in those error responses [1].

Exploitation

An attacker can exploit this via crafted HTTP requests that include malicious script or HTML in specific parameters. No authentication is required, as the vulnerable interface is exposed over the network. The attacker must convince a victim user to interact with a specially crafted URL (e.g., via email or a malicious site) that triggers the reflected XSS in the iMonitor error page [1].

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the context of the victim's browser session with the iMonitor interface. This can lead to theft of session cookies, modification of page content, or phishing attacks against administrators who manage eDirectory via iMonitor [1].

Mitigation

For eDirectory 8.8.x, upgrade to version 8.8.2 and apply the second fix pack (ftf2). For eDirectory 8.7.3.x, upgrade to version 8.7.3 sp10. No workarounds are documented; applying the patches resolves the issue [1].