Oracle JDeveloper ADF Faces goButton XSS (October 2014 CPU)

Medium Nessus Plugin ID 78911


A software development application installed on the remote host is affected by a cross-site scripting vulnerability.


The version of Oracle JDeveloper installed on the remote host is missing a security patch. It is, therefore, affected by a cross-site scripting (XSS) vulnerability in the Application Development Framework (ADF) Faces subcomponent due to improper encoding of URLs that are specified as a target for the 'goButton' component. An unauthenticated, remote attacker can exploit this to execute arbitrary script code in a user's browser session.


Apply the appropriate patch according to the October 2014 Oracle Critical Patch Update advisory.

See Also

Plugin Details

Severity: Medium

ID: 78911

File Name: oracle_jdeveloper_cpu_oct_2014.nasl

Version: $Revision: 1.12 $

Type: local

Family: Misc.

Published: 2014/11/07

Modified: 2017/05/05

Dependencies: 78910

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C


Base Score: 4.7

Temporal Score: 4.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:oracle:fusion_middleware, cpe:/a:oracle:jdeveloper

Required KB Items: installed_sw/Oracle JDeveloper

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2014/10/14

Vulnerability Publication Date: 2014/10/14

Reference Information

CVE: CVE-2014-6522

BID: 70472

OSVDB: 113276

CWE: 20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990