Oracle Enterprise Manager Grid Control CVE-2013-0352 Cross Site Scripting Vulnerability

Bugtraq ID:	57365
Class:	Input Validation Error
CVE:	CVE-2013-0352
Remote:	Yes
Local:	No
Published:	Jan 15 2013 12:00AM
Updated:	Apr 24 2014 10:10PM
Credit:	Qinglin Jiang of Application Security Inc.
Vulnerable:
Not Vulnerable:

Oracle Enterprise Manager Grid Control CVE-2013-0352 Cross Site Scripting Vulnerability

Oracle Enterprise Manager Grid Control is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This vulnerability affects the following supported versions:
EM Base Platform: 10.2.0.5, 11.1.0.1; EM DB Control: 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3; EM Plugin for DB: 12.1.0.1, 12.1.0.2

Oracle Enterprise Manager Grid Control CVE-2013-0352 Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Oracle Enterprise Manager Grid Control CVE-2013-0352 Cross Site Scripting Vulnerability

References:

• Oracle Homepage (Oracle)