Cross site scripting

2007-01-1702:28:00

PRIOn knowledge base

www.prio-n.com

5.2 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

39.8%

JSON

Cross-site scripting (XSS) vulnerability in Oracle Reports Web Cartridge (RWCGI60) in the Workflow Cartridge component, as used in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 10.1.2; and Oracle E-Business Suite and Applications 11.5.10CU2; allows remote authenticated users to inject arbitrary HTML or web script via the genuser parameter to rwcgi60, aka OWF01.

CPENameOperatorVersion
application_servereq10.1.2.2
application_servereq10.1.2.0.2
application_servereq9.0.4.3
collaboration_suiteeq10.1.2
database_servereq9.2.0.8
database_servereq10.2.0.3
database_servereq10.1.0.5
e-business_suiteeq11.5.10.2

Name	Operator	Version
application_server	eq	10.1.2.2
application_server	eq	10.1.2.0.2
application_server	eq	9.0.4.3
collaboration_suite	eq	10.1.2
database_server	eq	9.2.0.8
database_server	eq	10.2.0.3
database_server	eq	10.1.0.5
e-business_suite	eq	11.5.10.2