JVNDB-2010-000004

Oracle Application Server vulnerable to cross-site scripting

Oracle Application Server from Oracle contains a cross-site scripting vulnerability.

Oracle Application Server from Oracle is an application server. Oracle Application Server contains a cross-site scripting vulnerability.

Daiki Fukumori reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 2.6 (Low) [IPA Score]

• Access Vector: Network
• Access Complexity: High
• Authentication: None
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

Oracle Corporation

• Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.4.0, 10.1.3.5, 10.1.3.5.1
• Oracle Application Server 10g Release 2 (10.1.2), version 10.1.2.3.0

An arbitrary script may be executed on the user's web browser.

[Update the Software]
Update to the latest version according to the information provided by the vendor.

Oracle Corporation

• Critical Patch Updates and Security Alerts : cpujan2010

1. JVN : JVN#50837839
2. Common Weakness Enumeration (CWE) : Cross-site scripting (CWE-79) [IPA Evaluation]

[2010/01/14]
  Web page published