Description
Cross-site scripting (XSS) vulnerability in Oracle Application Express (formerly HTML DB) before 2.2.1 allows remote attackers to inject arbitrary HTML or web script via the WWV_FLOW_ITEM_HELP package. NOTE: it is likely that this issue overlaps one of the Oracle VulnIDs covered by CVE-2006-5351. Oracle has not publicly disputed claims by a reliable researcher that this has been fixed by the October 2006 CPU.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://securityreason.com/securityalert/1792 ↗
- http://www.securityfocus.com/archive/1/449500/100/0/threaded ↗
- http://www.red-database-security.com/advisory/oracle_apex_css_wwv_flow_item_help.html ↗
- http://www.us-cert.gov/cas/techalerts/TA06-291A.html ↗
- http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2006.html ↗