NovellGroupWise Multiple Vulnerabilities

Multiple vulnerabilities have been identified in Novell GroupWise, which can be exploited by malicious people to conduct cross-site scripting, cross-site request forgery, and script insertion attacks, bypass certain security restrictions, or compromise a vulnerable system.

1. Input passed to the "User.id" and "Library.queryText" parameters in /gw/webacc is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML or script code in a user's browser session in context of an affected site.

2. Certain HTML emails or HTML attachments are not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious email is viewed.

3. A vulnerability is caused due to the application allowing the user to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g. add a forwarding rule or change certain settings.

4. A vulnerability is caused due to an error within the handling of HTTP POST requests. This can be exploited to convert POST requests into GET requests, which can be used to gain access to certain restricted GroupWise information.

5. An unspecified error exists within the Novell GroupWise Internet Agent (GWIA), which can be exploited to cause a buffer overflow and execute arbitrary code on a vulnerable system.

The vulnerabilities are reported in version GroupWise 6.5x, GroupWise 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and GroupWise 8.0. Other versions may also be affected.