CVE-2005-3204: XSS

Published Oct 14, 2005

Updated

Cross-site scripting (XSS) vulnerability in Oracle XML DB 9iR2 allows remote attackers to inject arbitrary web script or HTML via the query string in an HTTP request.

Affected Software

53 affected components

Oracle Application Server=9.0.2

Oracle Application Server=9.0.2.0.0

Oracle Application Server=9.0.2.0.1

Oracle Application Server=9.0.2.1

Oracle Application Server=9.0.2.2

Oracle Application Server=9.0.2.3

Oracle Application Server=9.0.3

Oracle Application Server=9.0.3.1

Oracle Application Server=9.2.0.6

Oracle Oracle9i=client_9.2.0.1

Oracle Oracle9i=client_9.2.0.2

Oracle Oracle9i=developer_9.0.4

Oracle Oracle9i=enterprise_9.0.1

Oracle Oracle9i=enterprise_9.0.1.4

Oracle Oracle9i=enterprise_9.0.1.5

Oracle Oracle9i=enterprise_9.0.1.5_fips

Oracle Oracle9i=enterprise_9.0.4

Oracle Oracle9i=enterprise_9.2.0

Oracle Oracle9i=enterprise_9.2.0.1

Oracle Oracle9i=enterprise_9.2.0.2

Oracle Oracle9i=enterprise_9.2.0.3

Oracle Oracle9i=enterprise_9.2.0.4

Oracle Oracle9i=enterprise_9.2.0.5

Oracle Oracle9i=enterprise_9.2.0.6

Oracle Oracle9i=personal_9.0.1

Oracle Oracle9i=personal_9.0.1.4

Oracle Oracle9i=personal_9.0.1.5

Oracle Oracle9i=personal_9.0.1.5_fips

Oracle Oracle9i=personal_9.0.4

Oracle Oracle9i=personal_9.2

Oracle Oracle9i=personal_9.2.0.1

Oracle Oracle9i=personal_9.2.0.2

Oracle Oracle9i=personal_9.2.0.3

Oracle Oracle9i=personal_9.2.0.4

Oracle Oracle9i=personal_9.2.0.5

Oracle Oracle9i=personal_9.2.0.6

Oracle Oracle9i=standard_9.0

Oracle Oracle9i=standard_9.0.1

Oracle Oracle9i=standard_9.0.1.2

Oracle Oracle9i=standard_9.0.1.3

Oracle Oracle9i=standard_9.0.1.4

Oracle Oracle9i=standard_9.0.1.5

Oracle Oracle9i=standard_9.0.1.5_fips

Oracle Oracle9i=standard_9.0.2

Oracle Oracle9i=standard_9.0.4

Oracle Oracle9i=standard_9.2

Oracle Oracle9i=standard_9.2.0.1

Oracle Oracle9i=standard_9.2.0.2

Oracle Oracle9i=standard_9.2.0.3

Oracle Oracle9i=standard_9.2.0.4

Oracle Oracle9i=standard_9.2.0.5

Oracle Oracle9i=standard_9.2.0.6

Oracle Oracle9i=standard_9.2.3

Remediation

Patch Available

http://secunia.com/advisories/15991/

Event History

Oct 14, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-3204?

CVE-2005-3204 is classified as a medium severity vulnerability due to its potential for exploitation through cross-site scripting.

How do I fix CVE-2005-3204?

To mitigate CVE-2005-3204, apply the latest security patches provided by Oracle for affected versions of Oracle XML DB.

What versions are affected by CVE-2005-3204?

CVE-2005-3204 affects multiple versions of Oracle XML DB, including Oracle9i and Oracle Application Server versions listed in the vulnerability report.

What are the potential impacts of CVE-2005-3204?

The exploitation of CVE-2005-3204 can lead to unauthorized access to user sessions and potential theft of sensitive information.

Is there a workaround for CVE-2005-3204?

As a temporary workaround for CVE-2005-3204, web application firewall rules can be implemented to filter malicious input.