CVE-2007-0275: XSS

Published Jan 17, 2007

Updated

Cross-site scripting (XSS) vulnerability in Oracle Reports Web Cartridge (RWCGI60) in the Workflow Cartridge component, as used in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 10.1.2; and Oracle E-Business Suite and Applications 11.5.10CU2; allows remote authenticated users to inject arbitrary HTML or web script via the genuser parameter to rwcgi60, aka OWF01.

Affected Software

8 affected components

Oracle Application Server=9.0.4.3

Oracle Application Server=10.1.2.0.2

Oracle Application Server=10.1.2.2

Oracle Collaboration Suite=10.1.2

Oracle Database server=9.2.0.8

Oracle Database server=10.1.0.5

Oracle Database server=10.2.0.3

Oracle E-Business Suite=11.5.10.2

Remediation

Patch Available

http://secunia.com/advisories/23794

Event History

Jan 17, 2007

CVE Published

02:28 AM

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0275?

CVE-2007-0275 is classified as a medium severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2007-0275?

To address CVE-2007-0275, upgrade to the latest version of the affected Oracle products listed in the vulnerability report.

What products are affected by CVE-2007-0275?

CVE-2007-0275 affects several Oracle products including Oracle Database versions 9.2.0.8, 10.1.0.5, 10.2.0.3, Oracle Application Server versions 9.0.4.3, 10.1.2.0.2, and 10.1.2.2, as well as Oracle Collaboration Suite 10.1.2 and Oracle E-Business Suite.

When was CVE-2007-0275 disclosed?

CVE-2007-0275 was disclosed in January 2007 as part of a security advisory.

What are the consequences of exploiting CVE-2007-0275?

Exploiting CVE-2007-0275 could allow an attacker to execute arbitrary JavaScript in the context of another user’s session, leading to potential data theft or session hijacking.