This host is running Oracle HTTP Server and is prone to cross site scripting vulnerability.

Successful exploitation will allow attacker to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Impact Level: Application

Upgrade to Oracle HTTP Server 11g or later, For updates refer to http://www.oracle.com/technetwork/middleware/ias/downloads/index.html

The flaw is caused by improper validation of user-supplied input passed via the 'Expect' header from an HTTP request, which allows attackers to execute arbitrary HTML and script code on the web server.

Oracle HTTP Server for Oracle Application Server 10g Release 2.

• http://www.exploit-db.com/exploits/17393/
• http://www.securiteam.com/securityreviews/5KP0M1FJ5E.html

---

Updated on 2017-03-28