Unspecified vulnerability in the Secure Enterprise Search component in Oracle Database 10.1.8.3 allows remote attackers to affect integrity via unknown vectors. NOTE: the previous information was obtained from the July 2009 CPU. Oracle has not commented on claims from an established researcher that this is cross-site scripting (XSS) via the search_p_groups parameter in search/query/search.

The remote Oracle database server is missing the July 2009 Critical Patch Update (CPU) and therefore is potentially affected by security issues in the following components :

  - Advanced Replication

  - Auditing

  - Config Management

  - Core RDBMS

  - Listener

  - Network Foundation

  - Secure Enterprise Search

  - Upgrade

  - Visual Private Database

The version of Oracle Secure Enterprise Search installed on the remote host fails to sanitize input to the 'search_p_groups' parameter of the 'search/query/search' script before using it to generate dynamic HTML output.  An attacker may be able to leverage this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.

ID	Name	Product	Family	Type	Severity
56065	Oracle Database Multiple Vulnerabilities (July 2009 CPU)	Nessus	Databases	Combined	high
40550	Oracle Database Secure Enterprise Search search/query/search search_p_groups Parameter XSS	Nessus	CGI abuses : XSS	Remote	medium

Detections

Analytics

CVE-2009-1968

medium

Tenable Plugins

high

medium