Lucene search

[email protected]CVE-2007-2119

HistoryApr 18, 2007 - 6:19 p.m.

CVE-2007-2119

2007-04-1818:19:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2007-2119

xss

boundary_rules.jsp

administration front end

oracle enterprise search

database server

application server

remote attack

html injection

web script

security vulnerability

5.7 Medium

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.056 Low

EPSS

Percentile

93.2%

JSON

Cross-site scripting (XSS) vulnerability in boundary_rules.jsp in the Administration Front End for Oracle Enterprise (Ultra) Search, as used in Database Server 9.2.0.8, 10.1.0.5, and 10.2.0.2, and in Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2.0 allows remote attackers to inject arbitrary HTML or web script via the EXPTYPE parameter, aka SES01.

CPENameOperatorVersion
oracle:database_serveroracle database servereq10.2.0.2
oracle:application_serveroracle application servereq10.1.2.2
oracle:application_serveroracle application servereq10.1.2.0.2
oracle:database_serveroracle database servereq9.2.0.8
oracle:application_serveroracle application servereq9.0.4.3
oracle:database_serveroracle database servereq10.1.0.5

CPE	Name	Operator	Version
oracle:database_server	oracle database server	eq	10.2.0.2
oracle:application_server	oracle application server	eq	10.1.2.2
oracle:application_server	oracle application server	eq	10.1.2.0.2
oracle:database_server	oracle database server	eq	9.2.0.8
oracle:application_server	oracle application server	eq	9.0.4.3
oracle:database_server	oracle database server	eq	10.1.0.5

References

www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html

www.red-database-security.com/advisory/oracle_cpu_apr_2007.html

www.red-database-security.com/advisory/oracle_css_ses.html

www.securityfocus.com/archive/1/466156/100/0/threaded

www.securityfocus.com/archive/1/466329/100/200/threaded

www.securityfocus.com/bid/23532

www.securitytracker.com/id?1017927

www.us-cert.gov/cas/techalerts/TA07-108A.html

www.vupen.com/english/advisories/2007/1426

5.7 Medium

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.056 Low

EPSS

Percentile

93.2%

JSON

Related for CVE-2007-2119

prion1 nessus2