Cross-Site-Scripting Vulnerability in Oracle XMLDB

2005.10.07
Risk: Low
Local: No
Remote: Yes
CWE: N/A


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Cross-Site-Scripting Vulnerability in Oracle XMLDB ################################################## Name Cross-Site-Scripting Vulnerability in Oracle XMLDB Systems Affected Oracle Database 9i Rel. 2 Severity Low Risk Category Cross Site Scripting (CSS/XSS) Vendor URL http://www.oracle.com This advisory http://www.red-database-security.com/advisory/oracle_xmldb_css.html Author Alexander Kornbrust (ak at red-database-security.com) Date 7 October 2005 (V 1.00) Details ######## Oracle XML DB is a feature of the Oracle Database. It provides a high-performance , native XML retrieval and storage technology. It fully absorbs the W3C XML data model into the Oracle Database, and provides new standard access methods for navigating and querying XML. Oracle XML DB is vulnerable against cross site scripting. Affected Products ################# Oracle Database 9i Release 2 Testcase ######## http://scott:tiger@myserver:8080/oradb<script>alert('Hi')</script>/SCOTT /EMP Affected systems ################ Tested with Oracle Database 9.0.2.4. Patch Information ################# This bug is fixed with Critical Patch Update July 2005 (CPU July 2005). Oracle forgot to inform Red-Database-Security that this bug is fixed with CPU July 2005. All already published alerts are available on the web site of Red-Database-Security GmbH http://www.red-database-security.com/advisory/published_alerts.html History ####### 9-oct-2003 Oracle secalert was informed 10-oct-2003 Bug confirmed 12-jul-2005 Oracle published CPU July 2005 without informing Red-Database-Security that this bug is already fixed. 07-oct-2005 Red-Database-Security published this advisory &#169; 2005 by Red-Database-Security GmbH - last update 7-october-2005


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top