Detections
Analytics
PeopleSoft PeopleTools JMS Listening Connector Activity Parameter XSS
medium Nessus Plugin ID 42352
Language:
Synopsis
The remote web server hosts an application that is prone to a cross-site scripting attack.Description
The remote web server is running an instance of PeopleSoft PeopleTools that fails to sanitize user-supplied input to the 'Activity' parameter on submission to the JMS Listening Connector Administrator interface before using it to generate dynamic HTML output. An attacker may be able to leverage this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.Solution
Upgrade to version 8.49.22 or later.See Also
Plugin Details
Severity: Medium
ID: 42352
File Name: peoplesoft_jmslca_activity_xss.nasl
Version: 1.16
Type: remote
Family: CGI abuses : XSS
Published: 10/29/2009
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.5
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:oracle:peoplesoft_enterprise_peopletools
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Patch Publication Date: 7/14/2009
Vulnerability Publication Date: 7/27/2009
Reference Information
CVE: CVE-2009-1987
BID: 35691