Name Oracle Siebel eBusiness Application – Multiple Cross Site Scripting Vulnerabilities
Vendor Website http://www.oracle.com/us/products/applications/ebusiness/index.html
Date Released 18th October 2010 – CVE-2010-2406
Affected Software Oracle Siebel Suite 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199
Researcher Roberto Suggi Liverani
Security-Assessment.com has discovered that two components of the Siebel eBusiness Application Suite are vulnerable to reflected Cross Site Scripting attacks. The vulnerabilities can be exploited by both authenticated and unauthenticated remote users.
The following components have been found vulnerable:
- Siebel Web Engine;
- Siebel eBusiness Search Center.
The table below details where Cross Site Scripting was detected and which parameters are vulnerable:
Page Affected Method Variable
Siebel Web Engine - Public page:
Some Siebel eBusiness Applications require the attacker to change
the injection using variations such as ">,'>, %22%3E, '}, ') .
Vulnerable parameter: URL parameter replacing start.swe
Siebel eBusiness Search Center - Only authenticated user can access this page:
Method: GET, POST
V vulnerable parameter: Id
Oracle has created a fix for this vulnerability which has been included as part of Critical Patch Update Advisory - October 2010. Security-Assessment.com recommends all users of Oracle eBusiness Suite to upgrade to the latest version as soon as possible. For more information on the new release of Oracle eBusines Suite patch please refer to the release notes:
- permalink -