PT-2005-3293 · Oracle · Oracle Reports

Alexander Kornbrust · Published 2005-07-26 · Updated 2016-10-18 · CVE-2005-2379

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Reports version 9.0.2

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via several parameters, including the debug parameter to showenv, the test parameter to parsequery, or the delimiter or CELLWRAPPER parameter to rwservlet.

Recommendations For Oracle Reports version 9.0.2, consider disabling the showenv, parsequery, and rwservlet functions until a patch is available to prevent exploitation through the debug, test, delimiter, and CELLWRAPPER parameters. Restrict access to these parameters to minimize the risk of XSS attacks.

Exploit

Fix

Related Identifiers

CVE-2005-2379

Affected Products

Oracle Reports

References · 3

• 🔥 http://red-database-security.com/advisory/oracle_reports_various_css.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2379 · Security Note
• http://marc.info/?l=bugtraq&m=112181649831863&w=2 · Note