PT-2005-3293 · Oracle · Oracle Reports

Alexander Kornbrust · Publicado 2005-07-26 · Atualizado 2016-10-18 · CVE-2005-2379

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Reports version 9.0.2

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via several parameters, including the debug parameter to showenv, the test parameter to parsequery, or the delimiter or CELLWRAPPER parameter to rwservlet.

Recommendations For Oracle Reports version 9.0.2, consider disabling the showenv, parsequery, and rwservlet functions until a patch is available to prevent exploitation through the debug, test, delimiter, and CELLWRAPPER parameters. Restrict access to these parameters to minimize the risk of XSS attacks.

Exploit

Correção

Identificadores relacionados

CVE-2005-2379

Produtos afetados

Oracle Reports

Referências · 3

• 🔥 http://red-database-security.com/advisory/oracle_reports_various_css.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2379 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=112181649831863&w=2 · Nota