Oracle Enterprise Manager Grid Control CVE-2013-0355 Cross Site Scripting Vulnerability

Bugtraq ID:	57382
Class:	Unknown
CVE:	CVE-2013-0355
Remote:	Yes
Local:	No
Published:	Jan 15 2013 12:00AM
Updated:	Feb 25 2013 07:23PM
Credit:	Oracle
Vulnerable:
Not Vulnerable:

Oracle Enterprise Manager Grid Control CVE-2013-0355 Cross Site Scripting Vulnerability

Oracle Enterprise Manager Grid Control is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

This vulnerability affects the following supported versions:
EM Base Platform: 10.2.0.5, 11.1.0.1; EM DB Control: 11.1.0.7, 11.2.0.2, 11.2.0.3

Oracle Enterprise Manager Grid Control CVE-2013-0355 Cross Site Scripting Vulnerability

To exploit this issue, attackers must entice an unsuspecting user into visiting a specially crafted URI.

Oracle Enterprise Manager Grid Control CVE-2013-0355 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oracle Enterprise Manager Grid Control CVE-2013-0355 Cross Site Scripting Vulnerability

References:

• Oracle Homepage (Oracle)