CVE-2009-0273

Vulnerability

Novell GroupWise WebAccess versions 6.5x, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 contain multiple cross-site scripting (XSS) vulnerabilities. The issues arise from improper sanitization of user-supplied input in the User.id and Library.queryText parameters passed to gw/webacc, as well as in HTML email content and HTML attachments. These flaws allow both persistent and non-persistent XSS attacks [1][2].

Exploitation

An attacker can exploit these vulnerabilities by crafting malicious script or HTML and embedding it in the affected parameters, or by sending a specially crafted HTML email or attachment to a GroupWise user. The attack requires no special network position beyond normal web access to the GroupWise WebAccess interface. For the persistent variant, the injected script is stored and executed when other users view the affected content. For the non-persistent variant, a POST request with malicious payload can trigger script execution [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the context of the victim's browser. This can lead to persistent defacement of the target site, theft of confidential information, or redirection to unauthorized third parties. The impact is limited to the web application layer and does not grant direct server-side control [1][2].

Mitigation

For GroupWise 7.x systems, apply GroupWise 7.03 Hot Patch 2 (HP2) or later. For GroupWise 8.0 systems, apply GroupWise 8.0 Hot Patch 1 (HP1) or later. GroupWise 6.5x is end-of-life and must be upgraded to a supported, patched version [1][2].