Detections
Analytics
Oracle Database Secure Enterprise Search search/query/search search_p_groups Parameter XSS
medium Nessus Plugin ID 40550
Language:
Synopsis
The remote web server uses a script that is affected by a cross-site scripting vulnerability.Description
The version of Oracle Secure Enterprise Search installed on the remote host fails to sanitize input to the 'search_p_groups' parameter of the 'search/query/search' script before using it to generate dynamic HTML output. An attacker may be able to leverage this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.Solution
Upgrade to Secure Enterprise Search version 10.1.8.3 or later.See Also
http://web.archive.org/web/20130618121027/http://dsecrg.com/pages/vul/show.php?id=125
https://seclists.org/bugtraq/2009/Jul/109
https://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
Plugin Details
Severity: Medium
ID: 40550
File Name: oracle_ses_search_p_groups_xss.nasl
Version: 1.20
Type: remote
Family: CGI abuses : XSS
Published: 8/11/2009
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:oracle:database_server
Exploit Ease: No exploit is required
Exploited by Nessus: true
Patch Publication Date: 7/14/2009
Vulnerability Publication Date: 7/14/2009
Reference Information
CVE: CVE-2009-1968
BID: 35681