This host is running OracleJSP Demos and is prone to multiple cross site scripting vulnerabilities.

Successful exploitation could allow an attacker to execute arbitrary scripts or actions written by an attacker. In addition, an attacker may obtain authorization cookies that would allow him to gain unauthorized access to the application. Impact Level: Application

Apply the patch from below link, http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html

The flaws are due to failure in the, - '/demo/sql/index.jsp' script to properly sanitize user supplied input in 'connStr' parameter. - '/demo/basic/hellouser/hellouser.jsp' script to properly sanitize user-supplied input in 'newName' parameter. - '/demo/basic/hellouser/hellouser_jml.jsp' script to properly sanitize user-supplied input in 'newName' parameter. - '/demo/basic/simple/welcomeuser.jsp' script to properly sanitize user-supplied input in 'user' parameter. - '/demo/basic/simple/usebean.jsp?' script to properly sanitize user-supplied input in 'newName' parameter.

OracleJSP Demos version 1.1.2.4.0 with iAS v1.0.2.2

• http://packetstormsecurity.org/files/view/100650/cybsecoraclejsp-xss.txt
• http://www.gossamer-threads.com/lists/fulldisc/full-disclosure/79673
• http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html

---

Updated on 2015-03-25