CVE-2007-3553 : Detail

CVE-2007-3553

1.16%V3
Network
2007-07-03
19h00 +00:00
2017-07-28
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Cross-site scripting (XSS) vulnerability in Rapid Install Web Server in Oracle Application Server 11i allows remote attackers to inject arbitrary web script or HTML via a URL to the "Secondary Login Page", as demonstrated using (1) pls/ and (2) pls/MSBEP004/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 30256

Publication date : 2007-06-27 22h00 +00:00
Author : Kaushal Desai
EDB Verified : Yes

source: https://www.securityfocus.com/bid/24697/info Oracle Rapid Install Web Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to inject HTML and script code into the browser of an unsuspecting victim. The attacker may then steal cookie-based authentication credentials and launch other attacks. http://www.example.com:8004/pls/MSBEP004/<script>alert("XSS")</script> http://www.example.com:8004/pls/<script>alert("XSS")</script>

Products Mentioned

Configuraton 0

Oracle>>Application_server >> Version 11i

Oracle>>Rapid_install_web_server >> Version *

    References

    http://secunia.com/advisories/25919
    Tags : third-party-advisory, x_refsource_SECUNIA
    http://www.securityfocus.com/bid/24697
    Tags : vdb-entry, x_refsource_BID
    http://osvdb.org/37058
    Tags : vdb-entry, x_refsource_OSVDB
    http://www.securitytracker.com/id?1018329
    Tags : vdb-entry, x_refsource_SECTRACK