Oracle Reports Web Cartridge (RWCGI60) vulnerable to XSS
Cross-Site Scripting Vulnerability in Oracle Reports Web Cartridge (RWCGI60) via the genuser parameter.
Antecedentes
Reports Web CGI (Web Cartridge) is required for the reports server when Oracle Application Server (OAS) is used to process report requests from web clients.
Description
Incorrect validation of the genuser parameter allows script or HTML code to be injected and executed in the client's browser. This is especially serious in authentication forms, where a malicious user can obtain other users' credentials.
Business impact
An attacker can hijack the sessions of other authenticated users, obtain their credentials, or alter the authentication form page.
Affected systems
Oracle9i Application Server Release 2, version 9.0.2.3.
Solución
The January 2007 Critical Patch Update (CPU) contains fixes for this vulnerability.
Calendario de divulgación
References
The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.
Company based in Spain and Colombia, specializing in web application auditing, network security, penetration testing, and compliance implementation and assessment. Our clients include some of the largest finance, telecommunications, insurance, and ICT companies. A vendor-independent provider with in-depth experience since 2001. Our R&D efforts include vulnerability research, collaboration on open security projects, whitepapers, and participation in industry events.
Would you like us to review your product?
Contact usDo you need a security audit?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Our offices
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)