Novell Home

My Favorites

Close

Please to see your favorites.

Cross-site scripting vulnerability found on ZCC page

This document (7012500) is provided subject to the disclaimer at the end of this document.

Environment

Novell ZENworks Configuration Management 11.2 ZENworks Control Center - ZCC

Situation

Cross-site scripting vulnerability found in ZCC. This is a reflected XSS vulnerability, detected in an alert that was an immediate response to the injection.

Resolution

This is fixed in version 11.2.4 - see TID 7012027 "ZENworks Configuration Management 11.2.4 - update information and list of fixes" which can be found at http://www.novell.com/support/search.do?usemicrosite=true&searchString=7012027

For ZCM 11.2.3a: Workaround - if it is not possible to upgrade to ZCM 11.2.4 at this time, Novell has made a Patch  available for testing, as part of a Monthly patch update: it can be obtained at http://download.novell.com/Download?buildid=s5zcEae9xcI~ as "ZCM 11.2.3a Monthly Update 1 - see TID 7012025". This update should only be applied if the symptoms above are being experienced, and are causing problems.
Please report any problems encountered when using this Patch, by using the feedback link on this TID.

Also Fixed in 11.2.4 http://download.novell.com/Download?buildid=ZCUFlvDkC9w~

Change to njwc.jar was made. When the vulnerability uses as part of the onError, it will be ignored.

Cause

Root cause: In case of onError event , the vulnerability scenarios were not handled.

Status

Security Alert

Additional Information

Assigned CVE-2013-1095
OWASP 2010 A 2

Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7012500
  • Creation Date:28-MAY-13
  • Modified Date:16-JAN-14
    • NovellZENworks Configuration Management

Did this document solve your problem? Provide Feedback