CVE-2002-2347: XSS

Published Dec 31, 2002

Updated

Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field.

Affected Software

4 affected components

Oracle Application Server=1.0.2

Oracle Application Server=1.0.2.1s

Oracle Application Server=1.0.2.2

Oracle Application Server=9.0.2

Event History

Dec 31, 2002

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityWeaknessAffected Software

Oct 29, 2007

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2002-2347?

The severity of CVE-2002-2347 is classified as high due to the potential for remote attackers to execute arbitrary scripts.

How do I fix CVE-2002-2347?

To fix CVE-2002-2347, it is recommended to upgrade the affected Oracle Java Server Page demo files to a secured version that mitigates the XSS vulnerability.

Which versions of Oracle Application Server are affected by CVE-2002-2347?

CVE-2002-2347 affects Oracle Application Server versions 1.0.2, 1.0.2.1s, 1.0.2.2, and 9.0.2.

What type of vulnerability is CVE-2002-2347?

CVE-2002-2347 is classified as a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts.

What impact does CVE-2002-2347 have on web applications?

The impact of CVE-2002-2347 on web applications includes the potential for attackers to hijack user sessions, redirect users, or execute unwanted actions on behalf of a user.