Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2007-0275

Cross-site scripting (XSS) vulnerability in Oracle Reports Web Cartridge (RWCGI60) in the Workflow Cartridge component, as used in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 10.1.2; and Oracle E-Business Suite and Applications 11.5.10CU2; allows remote authenticated users to inject arbitrary HTML or web script via the genuser parameter to rwcgi60, aka OWF01.

Published

2007-01-17T02:28:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 3.5 (LOW)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: SINGLE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

6.8

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application oracle application_server 9.0.4.3 Yes
Application oracle application_server 10.1.2.0.2 Yes
Application oracle application_server 10.1.2.2 Yes
Application oracle collaboration_suite 10.1.2 Yes
Application oracle database_server 9.2.0.8 Yes
Application oracle database_server 10.1.0.5 Yes
Application oracle database_server 10.2.0.3 Yes
Application oracle e-business_suite 11.5.10.2 Yes
References