Name 	Cross-Site-Scripting Vulnerability in Oracle Secure Enterprise Search
Systems Affected 	Oracle Secure Enterprise Search 10.1.6- SES
Severity 	Medium Risk
Category 	Cross Site Scripting (XSS/CSS)
Vendor URL 	http://www.oracle.com/ 
Author 	Alexander Kornbrust (ak at red-database-security.com)
Date 	17 April 2007 (V 1.00)


Details
#######
Oracle Secure Enterprise Search 10g, a standalone product from Oracle, enables a secure, high quality, easy-to-use search across all enterprise information assets.

The parameter EXPTYPE in boundary_rules.jsp contains a cross site scripting vulnerability.

This advisory is available at
 


Exploit
#######
 


Affected Products
#################
Oracle Enterprise Search


Patch Information
#################
Please upgrade to the latest version of SES or apply CPU April 2007.



History
#######
05-Apr-2005 Oracle secalert was informed
06-Apr-2005 Bug confirmed
17-apr-2007 Oracle published CPU April 2007
17-apr-2007 Red-Database-Security published this advisory


Additional Information
######################
An analysis of the Oracle CPU April 2007 is available here 
 

This document will be updated during the next few days and weeks with the latest information.


(c) 2007 by Red-Database-Security GmbH
--
http://www.red-database-security.com