Detections
Analytics
Novell ZENworks Configuration Console Login.jsp language Parameter XSS
medium Nessus Plugin ID 66915
Language:
Synopsis
The remote web server hosts a script that is affected by a cross-site scripting vulnerability.Description
The remote web server hosts a version of the ZENworks Configuration Console that is affected by a cross-site scripting vulnerability. The 'language' parameter is not properly validated in 'Login.jsp' and can be tampered with to inject arbitrary script code in a user's browser via a specially crafted POST request.Note that hosts that are affected by this issue are also likely to be affected by other vulnerabilities.
Solution
Upgrade to 11.2.3a Monthly Update 1 or later.See Also
Plugin Details
Severity: Medium
ID: 66915
File Name: novell_zenworks_login_xss.nasl
Version: 1.7
Type: remote
Family: CGI abuses : XSS
Published: 6/18/2013
Updated: 6/5/2024
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:novell:zenworks_configuration_management
Required KB Items: www/zenworks_control_center
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Exploited by Nessus: true
Patch Publication Date: 6/4/2013
Vulnerability Publication Date: 6/4/2013
Reference Information
CVE: CVE-2013-1094
BID: 60318