Vulnerability in Oracle Application Server

CVE-2004-1877

The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password.

EPSS: 0.030 (86.0th percentile) — read the EPSS interpretation.

Affected products

Oracle Application_server — versions 1.0.2, 1.0.2.1s, 1.0.2.2
Oracle Http_server — versions 8.1.7, 9.0.1, 9.2.0
N/a — versions n/a

References

cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
cve@mitre.org (vdb-entry, x_refsource_XF)