header-logo
Suggest Exploit
vendor:
WebLogic Server
by:
SecurityFocus
7.5
CVSS
HIGH
Cross-Site Scripting
79
CWE
Product Name: WebLogic Server
Affected Version From: 10.3
Affected Version To: 10.3
Patch Exists: YES
Related CWE: N/A
CPE: oracle:weblogic_server
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010

Oracle WebLogic Server Cross-Site Scripting Vulnerability

An attacker with 'WLS Console Package' privileges can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mitigation:

Ensure that user-supplied input is properly sanitized before including it in dynamic content.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/35673/info

Oracle WebLogic Server is prone to a cross-site scripting vulnerability. An attacker with 'WLS Console Package' privileges can exploit this issue.

The attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This vulnerability affects Oracle WebLogic Server 10.3. 

http://www.example.com:7011/consolehelp/console-help.portal?_nfpb=true&_pageLabel=ConsoleHelpSearchPage&searchQuery="><script>alert('DSECRG')</script>

Navigation

Suggest Exploit

Services By CQR