Novell Teaming Multiple Vulnerabilities

vendor:

Teaming

by:

SecurityFocus

8.8

CVSS

HIGH

User-Enumeration Weakness and Multiple Cross-Site Scripting Vulnerabilities

200, 79

CWE

Product Name: Teaming

Affected Version From: 1.0.3

Affected Version To: 1.0.3

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Novell Teaming Multiple Vulnerabilities

A remote attacker can exploit the user-enumeration weakness to enumerate valid usernames and then perform brute-force attacks; other attacks are also possible. The attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mitigation:

Apply the latest security patches from the vendor.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/34531/info

Novell Teaming is prone to a user-enumeration weakness and multiple cross-site scripting vulnerabilities.

A remote attacker can exploit the user-enumeration weakness to enumerate valid usernames and then perform brute-force attacks; other attacks are also possible.

The attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Novell Teaming 1.0.3 is vulnerable; other versions may also be affected. 

https://www.example.com/web/guest/home?p_p_id=82&p_p_action=1&p_p_state=%3Cscript%3Ealert('xss+vulnerability')%3C/script%3E&p_p_mode=view&p_p_col_id=column-2&p_p_col_pos=1&p_p_col_count=2&_82_struts_action=%2Flanguage%2Fview&_82_languageId=de_DE