PT-2002-3059 · Oracle · Oracle Java Server Page+1

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2347

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Java Server Page (OJSP) versions 1.0.2, 1.0.2.1s, 1.0.2.2 in Oracle 9i Application Server 9.0.2

Description The issue is related to a cross-site scripting (XSS) vulnerability in certain demo files of Oracle Java Server Page (OJSP), specifically hellouser.jsp, welcomeuser.jsp, and usebean.jsp. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the text entry field.

Recommendations For Oracle Java Server Page (OJSP) versions 1.0.2, 1.0.2.1s, 1.0.2.2 in Oracle 9i Application Server 9.0.2, consider removing or restricting access to the vulnerable demo files hellouser.jsp, welcomeuser.jsp, and usebean.jsp to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2002-2347

Affected Products

Oracle 9I Application Server

Oracle Java Server Page

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-2347 · Security Note
• http://iss.net/security_center/static/9842.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2347 · Note
• http://otn.oracle.com/deploy/security/pdf/2002alert41rev1.pdf · Note
• http://securityfocus.com/bid/5452 · Note