Cross-Site-Scripting Vulnerability in Oracle Secure Enterprise Search (SES)
Name Cross-Site-Scripting Vulnerability in Oracle Secure Enterprise Search - SES01
Systems Affected Oracle Secure Enterprise Search 10.1.6- SES
Severity Medium Risk
Category Cross Site Scripting (XSS/CSS)
Vendor URL http://www.oracle.com/
Author Alexander Kornbrust (ak at red-database-security.com)
CVE
Date 17 April 2007 (V 1.00)
Details
Oracle Secure Enterprise Search 10g, a standalone product from Oracle, enables a secure, high quality, easy-to-use search across all enterprise information assets.
The parameter EXPTYPE in boundary_rules.jsp contains a cross site scripting vulnerability.
Affected Products
Oracle Enterprise Search <10.1.8
Patch Information
Please upgrade to the latest version of SES or apply CPU April 2007.
History
05-Apr-2005 Oracle secalert was informed
06-Apr-2005 Bug confirmed
17-apr-2007 Oracle published CPU April 2007
17-apr-2007 Red-Database-Security published this advisory
Ā© 2007 by Red-Database-Security GmbH - last update 17-apr-2007