Oracle Workflow Wf_monitor Cross-Site Scripting Vulnerability
BID:15145
Info
Oracle Workflow Wf_monitor Cross-Site Scripting Vulnerability
| Bugtraq ID: | 15145 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 19 2005 12:00AM |
| Updated: | Oct 19 2005 12:00AM |
| Credit: | Discovery is credited to Alexander Kornbrust <[email protected]>. |
| Vulnerable: |
Oracle Workflow 11.5.9 .5 Oracle Workflow 11.5.1 |
| Not Vulnerable: | |
Discussion
Oracle Workflow Wf_monitor Cross-Site Scripting Vulnerability
Oracle Workflow is prone to a cross-site scripting vulnerability.
This issue affects the 'wf_monitor' script.
An attacker may leverage this vulnerability to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
This issue was addressed in Oracle Critical Patch Update - October 2005 BID 15134 (Oracle October Security Update Multiple Vulnerabilities). This issue was also reported in BID 15139 (Oracle Workflow Multiple Unspecified Cross-Site Scripting Vulnerabilities). Due to the availability of more information, this vulnerability is being assigned a new BID.
Oracle Workflow is prone to a cross-site scripting vulnerability.
This issue affects the 'wf_monitor' script.
An attacker may leverage this vulnerability to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
This issue was addressed in Oracle Critical Patch Update - October 2005 BID 15134 (Oracle October Security Update Multiple Vulnerabilities). This issue was also reported in BID 15139 (Oracle Workflow Multiple Unspecified Cross-Site Scripting Vulnerabilities). Due to the availability of more information, this vulnerability is being assigned a new BID.
Exploit / POC
Oracle Workflow Wf_monitor Cross-Site Scripting Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
Oracle Workflow Wf_monitor Cross-Site Scripting Vulnerability
Solution:
Oracle has released a Critical Patch Update (Critical Patch Update - October 2005) to address this and other issues. Information regarding obtaining and applying appropriate patches can be found in the referenced Oracle Critical Patch Update.
Solution:
Oracle has released a Critical Patch Update (Critical Patch Update - October 2005) to address this and other issues. Information regarding obtaining and applying appropriate patches can be found in the referenced Oracle Critical Patch Update.
References
Oracle Workflow Wf_monitor Cross-Site Scripting Vulnerability
References:
References: