CVE-2008-5095

2008-11-1419:20:54

CWE-79

[email protected]

web.nvd.nist.gov

cve-2008-5095

cross-site scripting

xss

novell user application

identity manager roles based provisioning module

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.9%

JSON

Cross-site scripting (XSS) vulnerability in the Novell User Application 3.0.1, 3.5.0, and 3.5.1; and Identity Manager Roles Based Provisioning Module 3.6.0 and 3.6.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

Affected configurations

NVD

Node

novellidentity_manager_roles_based_provisioning_moduleMatch3.6.0

novellidentity_manager_roles_based_provisioning_moduleMatch3.6.1

novelluser_applicationMatch3.0.1

novelluser_applicationMatch3.5.0

novelluser_applicationMatch3.5.1

CPENameOperatorVersion
novell:identity_manager_roles_based_provisioning_modulenovell identity manager roles based provisioning moduleeq3.6.0
novell:identity_manager_roles_based_provisioning_modulenovell identity manager roles based provisioning moduleeq3.6.1
novell:user_applicationnovell user applicationeq3.0.1
novell:user_applicationnovell user applicationeq3.5.0
novell:user_applicationnovell user applicationeq3.5.1

CPE	Name	Operator	Version
novell:identity_manager_roles_based_provisioning_module	novell identity manager roles based provisioning module	eq	3.6.0
novell:identity_manager_roles_based_provisioning_module	novell identity manager roles based provisioning module	eq	3.6.1
novell:user_application	novell user application	eq	3.0.1
novell:user_application	novell user application	eq	3.5.0
novell:user_application	novell user application	eq	3.5.1