CVE-2016-5760 describes multiple cross-site scripting (XSS) vulnerabilities in the administrator console of Novell GroupWise versions prior to 2014 R2 Service Pack 1 Hot Patch 1. These flaws allow remote attackers to inject arbitrary web script or HTML through the 'token' parameter in login.jsp or the PATH_INFO to index.jsp. Rated Medium (CVSS 6.1), exploitation requires user interaction (UI:R) but has low attack complexity (AC:L), potentially leading to limited impact on confidentiality and integrity. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2012CPE matchmatch criteria | cpe:2.3:a:novell:groupwise:*:*:*:*:*:*:*:* | ||
2014CPE matchmatch criteria | cpe:2.3:a:novell:groupwise:2014:-:*:*:*:*:*:* | ||
2014CPE matchmatch criteria | cpe:2.3:a:novell:groupwise:2014:r2:*:*:*:*:*:* | ||
2014CPE matchmatch criteria | cpe:2.3:a:novell:groupwise:2014:sp1:*:*:*:*:*:* | ||
2014CPE matchmatch criteria | cpe:2.3:a:novell:groupwise:2014:sp2:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.