CVE-2005-2093: XSS

Published Jun 30, 2005

Updated

Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Application Server to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

Affected Software

1 affected component

Oracle Application Server=9.0.2

Event History

Jun 30, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2093?

The severity of CVE-2005-2093 is considered high due to its potential to allow remote code execution and data manipulation.

How do I fix CVE-2005-2093?

To fix CVE-2005-2093, upgrade to a patched version of Oracle 9i Application Server that addresses this vulnerability.

What types of attacks can CVE-2005-2093 enable?

CVE-2005-2093 can enable web cache poisoning, XSS attacks, and potentially bypass web application firewall protections.

Who is affected by CVE-2005-2093?

Users of Oracle 9i Application Server version 9.0.2 are specifically affected by CVE-2005-2093.

Can CVE-2005-2093 be exploited remotely?

Yes, CVE-2005-2093 can be exploited remotely through crafted HTTP requests.