CVE-2012-3219

Related Files

Oracle Enterprise Manager Segment Advisor URL Redirection

Posted Feb 22, 2013

Authored by Qinglin Jiang | Site appsecinc.com

Team SHATTER Security Advisory - Oracle Enterprise Manager Database Control Segment Advisor page is vulnerable to an arbitrary URL redirection/phishing vulnerability. An attacker may inject an arbitrary URL into the web application and force the application to redirect to it without any validation. This vulnerability can be used in phishing attacks to trick legitimate users to visit malicious sites without realizing it. The affected link and parameter are /em/console/database/xdb/XDBResource and cancelURL. Versions affected include Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3.

tags | advisory, web, arbitrary

advisories | CVE-2012-3219

SHA-256 | 3e1f7b8dd952616f02834e723183cf85039124c2b4eabdfbed4d636fa1c09fea

Download | Favorite | View