PT-2002-3059 · Oracle · Oracle Java Server Page+1

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-2347

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Java Server Page (OJSP) versions 1.0.2, 1.0.2.1s, 1.0.2.2 in Oracle 9i Application Server 9.0.2

Description The issue is related to a cross-site scripting (XSS) vulnerability in certain demo files of Oracle Java Server Page (OJSP), specifically hellouser.jsp, welcomeuser.jsp, and usebean.jsp. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the text entry field.

Recommendations For Oracle Java Server Page (OJSP) versions 1.0.2, 1.0.2.1s, 1.0.2.2 in Oracle 9i Application Server 9.0.2, consider removing or restricting access to the vulnerable demo files hellouser.jsp, welcomeuser.jsp, and usebean.jsp to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2002-2347

Produtos afetados

Oracle 9I Application Server

Oracle Java Server Page

Referências · 5

• http://iss.net/security_center/static/9842.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-2347 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2347 · Nota
• http://otn.oracle.com/deploy/security/pdf/2002alert41rev1.pdf · Nota
• http://securityfocus.com/bid/5452 · Nota