Lucene search

[email protected]CVE-2005-4549

HistoryDec 28, 2005 - 11:03 a.m.

CVE-2005-4549

2005-12-2811:03:00

[email protected]

web.nvd.nist.gov

cve-2005-4549

cross-site scripting

xss

oracle application server

oracleas

discussion forum portlet

remote attackers

portal schema

web script

html

forum article

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.6 Medium

AI Score

Confidence

High

0.037 Low

EPSS

Percentile

91.9%

JSON

Cross-site scripting (XSS) vulnerability in Oracle Application Server (OracleAS) Discussion Forum Portlet allows remote attackers to inject arbitrary web script or HTML via the (1) RowKeyValue parameter in the PORTAL schema; and the (2) title and (3) content input fields when creating an forum article.

Affected configurations

NVD

Node

oracleapplication_server_discussion_forum_portlet

CPENameOperatorVersion
oracle:application_server_discussion_forum_portletoracle application server discussion forum portleteq*

CPE	Name	Operator	Version
oracle:application_server_discussion_forum_portlet	oracle application server discussion forum portlet	eq	*

References

marc.info/?l=full-disclosure&m=113532626203708&w=2

securityreason.com/securityalert/298

securitytracker.com/id?1015405

www.securityfocus.com/bid/16048

www.vupen.com/english/advisories/2005/3085

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.6 Medium

AI Score

Confidence

High

0.037 Low

EPSS

Percentile

91.9%

JSON

Related for CVE-2005-4549

cvelist1 nvd1