CVE-2009-1762: Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess login page (aka gw/webacc) in Novell G...

Security readout for executives and security teams

CVE-2009-1762 is a cross-site scripting issue in the Novell GroupWise WebAccess login page. An attacker could make the page reflect malicious script or HTML through specific parameters. The main business risk is credential theft or user session abuse if a victim follows a crafted link to an exposed legacy WebAccess system. Exposure is most likely in organizations still running legacy Novell GroupWise 7.x WebAccess, especially where gw/webacc is reachable from the internet or broad internal networks. Modern environments are unlikely to be affected unless old GroupWise infrastructure remains active. Prioritize if legacy GroupWise WebAccess remains exposed to users or the internet. The issue is old and not KEV-listed, but login-page XSS can still support credential theft where affected systems remain in service. Mitigation focus: Upgrade GroupWise 7.x WebAccess to 7.03 HP2 or later where applicable.; Retire unsupported GroupWise WebAccess systems if upgrade is not feasible.; Restrict access to gw/webacc to trusted networks or authenticated access paths..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.