CVE-2006-7158

Severity

43%

Complexity

86%

Confidentiality

48%

This vulnerability is addressed in the following product update: http://www.oracle.com/technology/products/database/application_express/download.html

Cross-site scripting (XSS) vulnerability in Oracle Application Express (APEX) before 2.2.1, aka Oracle HTML DB, allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATION_MSG parameter. NOTE: it is likely that this issue overlaps one of the identifiers in CVE-2006-5351.

This vulnerability is addressed in the following product update: http://www.oracle.com/technology/products/database/application_express/download.html

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N).

Overview

First reported 17 years ago

2007-03-07 20:19:00

Last updated 6 years ago

2018-10-16 16:29:00

Affected Software

Oracle APEX HTMLDB

References

22396

Vendor Advisory

2382

http://www.red-database-security.com/advisory/oracle_apex_css_notification_msg.html

Patch, Vendor Advisory

20061023 http://www.red-database-security.com/advisory/oracle_apex_css_notification_msg.html

oracle-notification-msg-xss(30107)

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.