Oracle Secure Enterprise Search 'search_p_groups' Parameter Cross Site Scripting Vulnerability

Bugtraq ID:	35681
Class:	Input Validation Error
CVE:	CVE-2009-1968
Remote:	Yes
Local:	No
Published:	Jul 14 2009 12:00AM
Updated:	Jul 17 2009 05:06PM
Credit:	Alexandr Polyakov of Digital Security Research Group
Vulnerable:	Oracle Secure Enterprise Search 10g 10.1.8 .2.0 Oracle Oracle10g Standard Edition 10.2 .3 Oracle Oracle10g Standard Edition 10.2.0.4 Oracle Oracle10g Personal Edition 10.2 .3 Oracle Oracle10g Personal Edition 10.2.0.4 Oracle Oracle10g Enterprise Edition 10.2 .3 Oracle Oracle10g Enterprise Edition 10.2.0.4
Not Vulnerable:

Oracle Secure Enterprise Search 'search_p_groups' Parameter Cross Site Scripting Vulnerability

Oracle Database is prone to a cross-site scripting vulnerability that affects the Secure Enterprise Search component.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Oracle Secure Enterprise Search 'search_p_groups' Parameter Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

An example URI is available:

• /data/vulnerabilities/exploits/35681.txt

Oracle Secure Enterprise Search 'search_p_groups' Parameter Cross Site Scripting Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for details.

Oracle Secure Enterprise Search 'search_p_groups' Parameter Cross Site Scripting Vulnerability

References:

• [DSECRG-09-025] Oracle Secure Enterprise Search 10.1.8 Linked XSS vulnerability (Alexandr Polyakov)
  
• [DSECRG-09-025] Oracle Secure Enterprise Search 10.1.8 Linked XSS vulnerability (DSecRG )
  
• Oracle Critical Patch Update Advisory - July 2009 (Oracle)