CVE-2008-0869

Description

Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.

Affected products

• bea / weblogic_server9.0 – 9.0
• bea / weblogic_server9.1 – 9.1
• bea / weblogic_server9.2 – 9.2
• bea / weblogic_workshop8.1 – 8.1
• bea / weblogic_workshop8.1 – 8.1
• bea / weblogic_workshop8.1 – 8.1
• bea / weblogic_workshop8.1 – 8.1
• bea / weblogic_workshop8.1 – 8.1
• bea_systems / weblogic10.0 – 10.0

References

• MISChttp://www.securitytracker.com/id?1019438
• MISChttp://dev2dev.bea.com/pub/advisory/263
• VENDOR_ADVISORYhttp://secunia.com/advisories/29041
• VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2008/0612/references
• VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2008/0611