Signature Detail
Short Name |
HTTP:XSS:ORACLE-GLASSFISH |
|---|---|
Severity |
Medium |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Oracle GlassFish Enterprise Server Cross Site Scripting |
Release Date |
2011/08/17 |
Update Number |
1975 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Oracle GlassFish Enterprise Server Cross Site Scripting
This signature detects attempts to exploit a known cross site scripting vulnerability in Oracle GlassFish Enterprise Server. It is due to insufficient validation of user-supplied input. Attackers can steal cookie-based authentication credentials and launch other attacks.
Extended Description
Oracle GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. This vulnerability affects the following supported versions: 2.1.1
Affected Products
- Sun Glassfish Enterprise Server 2.1.1
References