PT-2001-1360 · Oracle · Oracle Xsql Servlet

Publicado

2001-03-12

·

Atualizado

2017-10-10

·

CVE-2001-0126

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Oracle XSQL servlet version 1.0.3.0 and earlier
Description: The issue allows remote attackers to execute arbitrary Java code by redirecting the XSQL server to another source via the xml-stylesheet parameter in the xslt stylesheet.
Recommendations: For Oracle XSQL servlet version 1.0.3.0 and earlier, avoid using the xml-stylesheet parameter in the xslt stylesheet until the issue is resolved. As a temporary workaround, consider restricting access to the XSQL server to minimize the risk of exploitation.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2001-0126

Produtos afetados

Oracle Xsql Servlet