CVE-2007-2119: XSS

Published Apr 18, 2007

Updated

Cross-site scripting (XSS) vulnerability in boundaryrules.jsp in the Administration Front End for Oracle Enterprise (Ultra) Search, as used in Database Server 9.2.0.8, 10.1.0.5, and 10.2.0.2, and in Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2.0 allows remote attackers to inject arbitrary HTML or web script via the EXPTYPE parameter, aka SES01.

Affected Software

6 affected components

Oracle Application Server=9.0.4.3

Oracle Application Server=10.1.2.0.2

Oracle Application Server=10.1.2.2

Oracle Database Server=9.2.0.8

Oracle Database Server=10.1.0.5

Oracle Database Server=10.2.0.2

Event History

Apr 18, 2007

CVE Published

06:19 PM

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2119?

CVE-2007-2119 is classified as a medium severity Cross-site Scripting (XSS) vulnerability.

How do I fix CVE-2007-2119?

To fix CVE-2007-2119, it is recommended to apply the latest patches provided by Oracle for the affected software versions.

What software is affected by CVE-2007-2119?

CVE-2007-2119 affects Oracle Database Server versions 9.2.0.8, 10.1.0.5, 10.2.0.2 and Oracle Application Server versions 9.0.4.3, 10.1.2.0.2, 10.1.2.2.

What type of attack does CVE-2007-2119 enable?

CVE-2007-2119 enables remote attackers to execute arbitrary JavaScript code in the context of the user's session.

Are there any known exploits for CVE-2007-2119?

Yes, there are known exploits associated with CVE-2007-2119 that target the Cross-site Scripting vulnerability.