Oracle Supply Chain Products Suite CVE-2014-0371 Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	64886
Class:	Unknown
CVE:	CVE-2014-0371
Remote:	Yes
Local:	No
Published:	Jan 14 2014 12:00AM
Updated:	Mar 04 2014 01:23AM
Credit:	Oracle
Vulnerable:
Not Vulnerable:

Oracle Supply Chain Products Suite CVE-2014-0371 Multiple Cross Site Scripting Vulnerabilities

Oracle Supply Chain Products Suite is prone to multiple cross-site scripting vulnerabilities in Oracle Demantra Demand Management.

The vulnerability can be exploited over the 'HTTP' protocol. The 'DM Others' sub component is affected.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This vulnerability affects the following supported versions:
7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, 12.2.2

Oracle Supply Chain Products Suite CVE-2014-0371 Multiple Cross Site Scripting Vulnerabilities

The following example URIs are available:

http://www.example.com:8080/demantra/portal/editExecDefinition.jsp?menuBarId=2&menuGroupId=5&menuGroupName=Applications</title><script>alert('XSS')</script>&tkn=-308184887676887

http://www.example.com:8080/demantra/portal/htmlQuery.jsp?queryId=12510&view=0&levelId=null&memberId=null&comb=15525';}alert('XSS');function+aaa(){//271&tkn=427890217092227

Oracle Supply Chain Products Suite CVE-2014-0371 Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oracle Supply Chain Products Suite CVE-2014-0371 Multiple Cross Site Scripting Vulnerabilities

References: