BEA WebLogic 7.0/8.1 – Administration Console Error Page Cross-Site Scripting

漏洞ID	1055134	漏洞类型
发布时间	2005-05-27	更新时间	2005-05-27
CVE编号	N/A	CNNVD-ID	N/A
漏洞平台	JSP	CVSS评分	N/A

|漏洞来源

https://www.exploit-db.com/exploits/25739

|漏洞详情

漏洞细节尚未披露

|漏洞EXP

source: http://www.securityfocus.com/bid/13794/info

BEA WebLogic Server And WebLogic Express are affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the error page.

A successful attack may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue was originally released as part of BID 13717 (BEA WebLogic Server and WebLogic Express Multiple Remote Vulnerabilities). Due to the availability of more information, this vulnerability is being assigned a new BID. 

http://www.example.com:7001/console/a?=<script>alert(document.cookie)</script>

相关推荐: AIX sort Insecure Temporary File Creation Vulnerability

AIX sort Insecure Temporary File Creation Vulnerability 漏洞ID 1104968 漏洞类型 Origin Validation Error 发布时间 1998-04-15 更新时间 1998-04-15 …