CVE-2007-2592 Multiple cross-site scripting (XSS) vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless...
MediumCVSS 4.3
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to de/pda/dev_logon.asp and (2) multiple unspecified vectors in (a) usrmgr/registerAccount.asp, (b) de/create_account.asp, and other files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nokia groupwise mobile server | All versions | No fix listed |
| nokia intellisync mobile suite | = 6.4.31.2 | No fix listed |
| nokia intellisync mobile suite | = 6.6.0.107 | No fix listed |
| nokia intellisync mobile suite | = 6.6.2.2 | No fix listed |
| nokia intellisync wireless email express | All versions | No fix listed |
References
- 34515 vdb-entry
- 34516 vdb-entry
- 34517 vdb-entry
- 25212 patch third-party-advisory vendor-advisory
- 26199 third-party-advisory
- 2689 third-party-advisory
- support.novell.com
- www.sec-consult.com exploit vendor-advisory
- 20070509 SEC Consult SA-20070509-0 :: Multiple vulnerabilites in Nokia Intellisync Mobile Suite & Wireless Email Express mailing-list
- 23889 vdb-entry
- 1018454 vdb-entry
- ADV-2007-1727 vdb-entry
- ADV-2007-2657 vdb-entry
- nokia-multiple-scripts-xss(34187) vdb-entry