Oracle Application Server DMS Cross Site Scripting Vulnerability

Bugtraq ID:	23102
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 22 2007 12:00AM
Updated:	Mar 23 2007 02:43PM
Credit:	Sea Shark is credited with the discovery of this vulnerability.
Vulnerable:	Oracle Application Server Release 2 10.1.2 .0.2 Oracle Application Server Release 2 10.1.2 .0.1 Oracle Application Server Release 2 10.1.2 .0.0
Not Vulnerable:

Oracle Application Server DMS Cross Site Scripting Vulnerability

Oracle Application Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to inject HTML and script code into the browser of an unsuspecting victim. The attacker may then steal cookie-based authentication credentials and launch other attacks.

Oracle Application Server version 10g Release 2 (10.1.2) is vulnerable to this issue.

Oracle Application Server DMS Cross Site Scripting Vulnerability

Attackers can use a browser to exploit this issue.

Oracle Application Server DMS Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Oracle Application Server DMS Cross Site Scripting Vulnerability

References:

• Oracle Application Server Home Page (Oracle)