Oracle Supply Chain Products Suite CVE-2014-0379 Multiple HTML Injection Vulnerabilities

Bugtraq ID:	64857
Class:	Unknown
CVE:	CVE-2014-0379
Remote:	Yes
Local:	No
Published:	Jan 14 2014 12:00AM
Updated:	Mar 04 2014 01:07AM
Credit:	Oracle
Vulnerable:
Not Vulnerable:

Oracle Supply Chain Products Suite CVE-2014-0379 Multiple HTML Injection Vulnerabilities

Oracle Supply Chain Products Suite is prone to multiple HTML-injection vulnerabilities in Oracle Demantra Demand Management.

The vulnerability can be exploited over the 'HTTP' protocol. The 'DM Others' sub component is affected.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

This vulnerability affects the following supported versions:
7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, 12.2.2

Oracle Supply Chain Products Suite CVE-2014-0379 Multiple HTML Injection Vulnerabilities

The following exploit is available:

• /data/vulnerabilities/exploits/64857.txt

Oracle Supply Chain Products Suite CVE-2014-0379 Multiple HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oracle Supply Chain Products Suite CVE-2014-0379 Multiple HTML Injection Vulnerabilities

References: