Vulnerability Note VU#798611
Oracle 9iAS contains cross-site scripting vulnerability in "htp.print"
The victim will be presented with information which the compromised site did not wish their visitors to be subjected. This could be used to "sniff" sensitive data from within the web page, including passwords, credit card numbers, and any arbitrary information the user inputs.
Oracle has released an alert to address this issue (Section 1-e). Oracle has released a the following patches for the following systems at http://metalink.oracle.com:
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Oracle||Affected||08 Feb 2002||06 Mar 2002|
CVSS Metrics (Learn More)
Our thanks to David Litchfield for discovering this instance of a Cross-Site Scripting vulnerability.
This document was written by Jason Rafail.
- CVE IDs: Unknown
- CERT Advisory: CA-2000-02
- Date Public: 06 Feb 2002
- Date First Published: 06 Mar 2002
- Date Last Updated: 06 Mar 2002
- Severity Metric: 4.22
- Document Revision: 18
If you have feedback, comments, or additional information about this vulnerability, please send us email.