Vulnerability in Oracle Application Server

CVE-2005-2093

Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Application Server to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

EPSS: 0.049 (91.3th percentile) — read the EPSS interpretation.

Affected products

Oracle Application_server — versions 9.0.2
N/a — versions n/a

References

cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)