CVE Vulnerability

CVE-2007-2592

Multiple cross-site scripting (XSS) vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to de/pda/dev_logon.asp and (2) multiple unspecified vectors in (a) usrmgr/registerAccount.asp, (b) de/create_account.asp, and other files.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

References
Link Resource
http://www.sec-consult.com/289.html Exploit Vendor Advisory
http://secunia.com/advisories/25212 Patch Vendor Advisory
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5005120.html
http://www.securityfocus.com/bid/23889
http://www.securitytracker.com/id?1018454
http://secunia.com/advisories/26199
http://securityreason.com/securityalert/2689
http://www.vupen.com/english/advisories/2007/2657
http://www.vupen.com/english/advisories/2007/1727
http://osvdb.org/34515
http://osvdb.org/34516
http://osvdb.org/34517
https://exchange.xforce.ibmcloud.com/vulnerabilities/34187
http://www.securityfocus.com/archive/1/468048/100/0/threaded
Configurations

Configuration 1

cpe:2.3:a:nokia:groupwise_mobile_server:*:*:*:*:*:*:*:*
cpe:2.3:a:nokia:intellisync_mobile_suite:6.4.31.2:*:*:*:*:*:*:*
cpe:2.3:a:nokia:intellisync_wireless_email_express:*:*:*:*:*:*:*:*
cpe:2.3:a:nokia:intellisync_mobile_suite:6.6.0.107:*:*:*:*:*:*:*
cpe:2.3:a:nokia:intellisync_mobile_suite:6.6.2.2:*:*:*:*:*:*:*
Information

Published : 2007-05-11 04:20

Updated : 2018-10-16 04:44

NVD link : CVE-2007-2592

Mitre link : CVE-2007-2592

Products Affected
No products.
CWE
NVD-CWE-Other