Novell Groupwise 6.5 Webaccess - HTML Injection

Author: Francisco Amato
type: webapps
platform: java
port: 
date_added: 2005-07-15  
date_updated: 2013-06-07  
verified: 1  
codes: CVE-2005-2276;OSVDB-18064  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 26001.txt  

source: https://www.securityfocus.com/bid/14310/info

Novell GroupWise WebAccess is prone to an HTML injection vulnerability. This may be used to inject hostile HTML and script code into the Web mail application. When a user opens an email containing the hostile code, it may be rendered in their browser.

Successful exploitation could potentially allow theft of cookie-based authentication. Other attacks are also possible.

<IMG SRC="j&#X41vascript:alert(document.cookie)">