Vulnerability in Oracle Database Server

CVE-2009-1968

Unspecified vulnerability in the Secure Enterprise Search component in Oracle Database 10.1.8.3 allows remote attackers to affect integrity via unknown vectors. NOTE: the previous information was obtained from the July 2009 CPU. Oracle has not commented on claims from an established researcher that this is cross-site scripting (XSS) via the search_p_groups parameter in search/query/search.

EPSS: 0.401 (98.5th percentile) — read the EPSS interpretation.

Affected products

Oracle Database_server — versions 10.1.8.3
N/a — versions n/a

References

secalert_us@oracle.com (mailing-list, x_refsource_BUGTRAQ)
secalert_us@oracle.com (vdb-entry, x_refsource_XF)
secalert_us@oracle.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
secalert_us@oracle.com (Patch, vdb-entry, x_refsource_VUPEN, Vendor Advisory)
secalert_us@oracle.com (x_refsource_OSVDB, vdb-entry)
secalert_us@oracle.com (x_refsource_CONFIRM)
secalert_us@oracle.com (x_refsource_MISC)
secalert_us@oracle.com (vdb-entry, x_refsource_SECTRACK)
secalert_us@oracle.com (vdb-entry, x_refsource_BID)