CVE-2010-2778

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the WebAccess component of Novell GroupWise. The flaw lies in improper sanitization of HTML messages; when a crafted message is delivered to a user's WebAccess mailbox and viewed, the malicious script executes in the context of the browser. Affected versions include GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0 SP2. The issue is described in the advisory as a "Javascript XSS exploit" [1].

Exploitation

An attacker does not require authentication to exploit this vulnerability. They can send a specially crafted HTML message (containing malicious client-side script) to any GroupWise WebAccess user. When the victim views the message through WebAccess, the application renders the script without proper sanitization, allowing the script to run in the victim's browser session. No user interaction beyond viewing the message is necessary [1].

Impact

Successful exploitation allows the attacker to inject arbitrary web script or HTML into the context of the victim's WebAccess session. This can lead to the compromise of the user's WebAccess credentials, information disclosure, or other client-side attacks. The CVSS v2 score is 4.3 (medium), with partial confidentiality impact and no impact on integrity or availability [1].

Mitigation

Novell released fixes for this vulnerability. For GroupWise 7.x, the fix is included in 7.0 post-SP4 FTF (Feature Technical Fix). For GroupWise 8.x, the fix is included in 8.0 Service Pack 2 (SP2). Organizations should upgrade to these patched versions or apply the appropriate FTF/SP. No known workaround is detailed in the references, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog [1].