PeopleSoft Human Resources Management System Cross-Site Scripting Vulnerability
BID:11275
Info
PeopleSoft Human Resources Management System Cross-Site Scripting Vulnerability
| Bugtraq ID: | 11275 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 29 2004 12:00AM |
| Updated: | Sep 29 2004 12:00AM |
| Credit: | Discovery is credited to AUSCERT. |
| Vulnerable: |
PeopleSoft HRMS 7.0 |
| Not Vulnerable: | |
Discussion
PeopleSoft Human Resources Management System Cross-Site Scripting Vulnerability
PeopleSoft Human Resources Management System (HRMS) is reported prone to a cross-site scripting vulnerability. This issue exists due to insufficient sanitization of user-supplied data and may allow a remote attacker to execute arbitrary script code in a vulnerable user's browser.
This issue presents itself in some unspecified debugging and utility scripts that are supplied with the default installation. It is reported that successful exploitation of this issue can disclose sensitive data to an attacker.
This vulnerability is reported to affect HRMS version 7.0, however, it is possible that other versions are affected as well.
PeopleSoft Human Resources Management System (HRMS) is reported prone to a cross-site scripting vulnerability. This issue exists due to insufficient sanitization of user-supplied data and may allow a remote attacker to execute arbitrary script code in a vulnerable user's browser.
This issue presents itself in some unspecified debugging and utility scripts that are supplied with the default installation. It is reported that successful exploitation of this issue can disclose sensitive data to an attacker.
This vulnerability is reported to affect HRMS version 7.0, however, it is possible that other versions are affected as well.
Exploit / POC
PeopleSoft Human Resources Management System Cross-Site Scripting Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
PeopleSoft Human Resources Management System Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PeopleSoft Human Resources Management System Cross-Site Scripting Vulnerability
References:
References:
- PeopleSoft Homepage (PeopleSoft)
- PeopleSoft Human Resources Management System (HRMS) (SecurityTracker)