[ERPSCAN-17-005] Oracle PeopleSoft - XSS vulnerability CVE-2017-3300
ERPScan inc <[email protected]> Mon, 23 Jan 2017 16:45:44 +0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CANHWe911u+1EoS9NdDs6opmNPmctXSGJQAKX=xfJcDfUW19+9A@mail.gmail.com> |
QXBwbGljYXRpb246IE9yYWNsZSBQZW9wbGVTb2Z0CgpWZW5kb3I6IE9yYWNsZQoKQnVnczogWFhT CgpSZXBvcnRlZDogMzEuMTAuMjAxNgoKVmVuZG9yIHJlc3BvbnNlOiAxLjExLjIwMTYKCkRhdGUg b2YgUHVibGljIEFkdmlzb3J5OiAxNy4wMS4yMDE3CgpSZWZlcmVuY2U6IE9yYWNsZSBDUFUgSmFu IDIwMTcKCkF1dGhvcnM6IFZhaGFnbiBWYXJkYW55YW4sIERtaXRyeSBZdWRpbgoKCgoxLiBBRFZJ U09SWSBJTkZPUk1BVElPTgoKVGl0bGU6IE9yYWNsZSBQZW9wbGVTb2Z0IOKAkyBYU1MgdnVsbmVy YWJpbGl0eQoKQWR2aXNvcnkgSUQ6IFtFUlBTQ0FOLTE3LTAwNV0KClJpc2s6IEhpZ2gKCkFkdmlz b3J5IFVSTDoKaHR0cHM6Ly9lcnBzY2FuLmNvbS9hZHZpc29yaWVzL2VycHNjYW4tMTctMDA1LW9y YWNsZS1wZW9wbGVzb2Z0LXhzcy12dWxuZXJhYmlsaXR5LwoKRGF0ZSBwdWJsaXNoZWQ6IDE3LjAx LjIwMTcKClZlbmRvciBjb250YWN0ZWQ6IE9yYWNsZQoKCgoyLiBWVUxORVJBQklMSVRZIElORk9S TUFUSU9OCgpDbGFzczogWFNTIFtDV0UtNzldCgpSZW1vdGVseSBFeHBsb2l0YWJsZTogWWVzCgpM b2NhbGx5IEV4cGxvaXRhYmxlOiBObwoKQ1ZFIE5hbWU6IENWRS0yMDE3LTMzMDAKCkNWU1MgQmFz ZSBTY29yZTogNi4xCgoKCjMuIFZVTE5FUkFCSUxJVFkgREVTQ1JJUFRJT04KCkFuIGF0dGFja2Vy IGNhbiB1c2UgYSBzcGVjaWFsIEhUVFAgcmVxdWVzdCB0byBoaWphY2sgc2Vzc2lvbiBkYXRhIG9m CmFkbWluaXN0cmF0b3JzIG9yIHVzZXJzLgoKCgo0LiBWVUxORVJBQkxFIFBBQ0tBR0VTCgoKJCBw c3JlbGVhc2VpbmZvCgpUb29sc1JlbGVhc2U6IDguNTUuMDMKClRvb2xzUmVsZWFzZURCOiA4LjU1 CgoKClBlb3BsZVNvZnQgSENNIDkuMgoKCgpQT1JUQUwud2FyL1dFQi1JTkYvbGliL21jZklNLmph cgoKCgokIG1kNXN1bSAuL1BPUlRBTC53YXIvV0VCLUlORi9saWIvbWNmSU0uamFyCgozNjk4MmM3 ZDNjMDU5ZWM5YzJkOWFhZjBjMzVhNjVkMyAuL1BPUlRBTC53YXIvV0VCLUlORi9saWIvbWNmSU0u amFyCgoKCjUuIFNPTFVUSU9OUyBBTkQgV09SS0FST1VORFMKCk9yYWNsZSBDUFUgSmFudWFyeSAy MDE3CgoKNi4gQVVUSE9SCgoKRG1pdHJpIFl1ZGluIChAcmV0NWV0KS9FUlBTY2FuICYgVmFoYWdu IFZhcmRhbnlhbiAoQHZhaF8xMyApL0VSUFNjYW4KCgoKNy4gVEVDSE5JQ0FMIERFU0NSSVBUSU9O CgoKCjcuMS4gUHJvb2Ygb2YgQ29uY2VwdAoKCgp4c3MKCgpodHRwOi8vbG9jYWxob3N0OjgwMDAv SU1TZXJ2bGV0P01ldGhvZD1NU05fUFJFU0VOQ0UmaW1fc2VydmVyX25hbWU9TVNOJmltX3NlcnZl cj0xMjcuMC4wLjE6ODAwMCZpbV90b191c2VyPSUzQ2ElMjB4bWxuczphPSUyN2h0dHA6Ly93d3cu dzMub3JnLzE5OTkveGh0bWwlMjclM0UlM0NhOmJvZHklMjBvbmxvYWQ9JTI3YWxlcnQlMjhkb2N1 bWVudC5sb2NhdGlvbiUyOSUyNy8lM0UlM0MvYSUzRQoKCgo4LiBSRVBPUlQgVElNRUxJTkUKClJl cG9ydGVkOiAgMzEuMTAuMjAxNgoKVmVuZG9yIHJlc3BvbnNlOiAxLjExLjIwMTYKCkRhdGUgb2Yg UHVibGljIEFkdmlzb3J5OiAxNy4wMS4yMDE3CgoKCjkuIFJFRkVSRU5DRVMKCmh0dHA6Ly93d3cu b3JhY2xlLmNvbS90ZWNobmV0d29yay9zZWN1cml0eS1hZHZpc29yeS9jcHVqYW4yMDE3LTI4ODE3 MjcuaHRtbApodHRwczovL2VycHNjYW4uY29tL2Fkdmlzb3JpZXMvZXJwc2Nhbi0xNy0wMDUtb3Jh Y2xlLXBlb3BsZXNvZnQteHNzLXZ1bG5lcmFiaWxpdHkvCgoxMC4gQUJPVVQgRVJQU2NhbiBSZXNl YXJjaAoKRVJQU2NhbiByZXNlYXJjaCB0ZWFtIHNwZWNpYWxpemVzIGluIHZ1bG5lcmFiaWxpdHkg cmVzZWFyY2ggYW5kIGFuYWx5c2lzIG9mCmNyaXRpY2FsIGVudGVycHJpc2UgYXBwbGljYXRpb25z LiBJdCB3YXMgYWNrbm93bGVkZ2VkIG11bHRpcGxlIHRpbWVzIGJ5IHRoZQpsYXJnZXN0IHNvZnR3 YXJlIHZlbmRvcnMgbGlrZSBTQVAsIE9yYWNsZSwgTWljcm9zb2Z0LCBJQk0sIFZNd2FyZSwgSFAg Zm9yCmRpc2NvdmVyaW5nIG1vcmUgdGhhbiA0MDAgdnVsbmVyYWJpbGl0aWVzIGluIHRoZWlyIHNv bHV0aW9ucyAoMjAwIG9mIHRoZW0KanVzdCBpbiBTQVAhKS4KCkVSUFNjYW4gcmVzZWFyY2hlcnMg YXJlIHByb3VkIG9mIGRpc2NvdmVyaW5nIG5ldyB0eXBlcyBvZiB2dWxuZXJhYmlsaXRpZXMKKFRP UCAxMCBXZWIgSGFja2luZyBUZWNobmlxdWVzIDIwMTIpIGFuZCBvZiB0aGUgIlRoZSBCZXN0IFNl cnZlci1TaWRlIEJ1ZyIKbm9taW5hdGlvbiBhdCBCbGFja0hhdCAyMDEzLgoKRVJQU2NhbiBleHBl cnRzIHBhcnRpY2lwYXRlZCBhcyBzcGVha2VycywgcHJlc2VudGVycywgYW5kIHRyYWluZXJzIGF0 IDYwKwpwcmltZSBpbnRlcm5hdGlvbmFsIHNlY3VyaXR5IGNvbmZlcmVuY2VzIGluIDI1KyBjb3Vu dHJpZXMgYWNyb3NzIHRoZQpjb250aW5lbnRzICggZS5nLiBCbGFja0hhdCwgUlNBLCBISVRCKSBh bmQgY29uZHVjdGVkIHByaXZhdGUgdHJhaW5pbmdzIGZvcgpzZXZlcmFsIEZvcnR1bmUgMjAwMCBj b21wYW5pZXMuCgpFUlBTY2FuIHJlc2VhcmNoZXJzIGNhcnJ5IG91dCB0aGUgRUFTLVNFQyBwcm9q ZWN0IHRoYXQgaXMgZm9jdXNlZCBvbgplbnRlcnByaXNlIGFwcGxpY2F0aW9uIHNlY3VyaXR5IGF3 YXJlbmVzcyBieSBpc3N1aW5nIGFubnVhbCBTQVAgc2VjdXJpdHkKcmVzZWFyY2hlcy4KCkVSUFNj YW4gZXhwZXJ0cyB3ZXJlIGludGVydmlld2VkIGluIHNwZWNpYWxpemVkIGluZm8tc2VjIHJlc291 cmNlcyBhbmQKZmVhdHVyZWQgaW4gbWFqb3IgbWVkaWEgd29ybGR3aWRlLiBBbW9uZyB0aGVtIHRo ZXJlIGFyZSBSZXV0ZXJzLCBZYWhvbywgU0MKTWFnYXppbmUsIFRoZSBSZWdpc3RlciwgQ0lPLCBQ QyBXb3JsZCwgRGFya1JlYWRpbmcsIEhlaXNlLCBDaGluYWJ5dGUsIGV0Yy4KCk91ciB0ZWFtIGNv bnNpc3RzIG9mIGhpZ2hseS1xdWFsaWZpZWQgcmVzZWFyY2hlcnMsIHNwZWNpYWxpemVkIGluIHZh cmlvdXMKZmllbGRzIG9mIGN5YmVyc2VjdXJpdHkgKGZyb20gd2ViIGFwcGxpY2F0aW9uIHRvIElD Uy9TQ0FEQSBzeXN0ZW1zKSwKZ2F0aGVyaW5nIHRoZWlyIGV4cGVyaWVuY2UgdG8gY29uZHVjdCB0 aGUgYmVzdCBTQVAgc2VjdXJpdHkgcmVzZWFyY2guCgoxMS4gQUJPVVQgRVJQU2NhbgoKRVJQU2Nh biBpcyB0aGUgbW9zdCByZXNwZWN0ZWQgYW5kIGNyZWRpYmxlIEJ1c2luZXNzIEFwcGxpY2F0aW9u CkN5YmVyc2VjdXJpdHkgcHJvdmlkZXIuIEZvdW5kZWQgaW4gMjAxMCwgdGhlIGNvbXBhbnkgb3Bl cmF0ZXMgZ2xvYmFsbHkgYW5kCmVuYWJsZXMgbGFyZ2UgT2lsIGFuZCBHYXMsIEZpbmFuY2lhbCwg UmV0YWlsIGFuZCBvdGhlciBvcmdhbml6YXRpb25zIHRvCnNlY3VyZSB0aGVpciBtaXNzaW9uLWNy aXRpY2FsIHByb2Nlc3Nlcy4gTmFtZWQgYXMgYW4g4oCYRW1lcmdpbmcgVmVuZG9y4oCZIGluClNl Y3VyaXR5IGJ5IENSTiwgbGlzdGVkIGFtb25nIOKAnFRPUCAxMDAgU0FQIFNvbHV0aW9uIHByb3Zp ZGVyc+KAnSBhbmQKZGlzdGluZ3Vpc2hlZCBieSAzMCsgb3RoZXIgYXdhcmRzLCBFUlBTY2FuIGlz IHRoZSBsZWFkaW5nIFNBUCBTRSBwYXJ0bmVyIGluCmRpc2NvdmVyaW5nIGFuZCByZXNvbHZpbmcg c2VjdXJpdHkgdnVsbmVyYWJpbGl0aWVzLiBFUlBTY2FuIGNvbnN1bHRhbnRzCndvcmsgd2l0aCBT QVAgU0UgaW4gV2FsbGRvcmYgdG8gYXNzaXN0IGluIGltcHJvdmluZyB0aGUgc2VjdXJpdHkgb2Yg dGhlaXIKbGF0ZXN0IHNvbHV0aW9ucy4KCkVSUFNjYW7igJlzIHByaW1hcnkgbWlzc2lvbiBpcyB0 byBjbG9zZSB0aGUgZ2FwIGJldHdlZW4gdGVjaG5pY2FsIGFuZApidXNpbmVzcyBzZWN1cml0eSwg YW5kIHByb3ZpZGUgc29sdXRpb25zIGZvciBDSVNPJ3MgdG8gZXZhbHVhdGUgYW5kIHNlY3VyZQpT QVAgYW5kIE9yYWNsZSBFUlAgc3lzdGVtcyBhbmQgYnVzaW5lc3MtY3JpdGljYWwgYXBwbGljYXRp b25zIGZyb20gYm90aApjeWJlcmF0dGFja3MgYW5kIGludGVybmFsIGZyYXVkLiBBcyBhIHJ1bGUs IG91ciBjbGllbnRzIGFyZSBsYXJnZQplbnRlcnByaXNlcywgRm9ydHVuZSAyMDAwIGNvbXBhbmll cyBhbmQgTVNQcywgd2hvc2UgcmVxdWlyZW1lbnRzIGFyZSB0bwphY3RpdmVseSBtb25pdG9yIGFu ZCBtYW5hZ2Ugc2VjdXJpdHkgb2YgdmFzdCBTQVAgYW5kIE9yYWNsZSBsYW5kc2NhcGVzIG9uIGEK Z2xvYmFsIHNjYWxlLgoKV2Ug4oCYZm9sbG93IHRoZSBzdW7igJkgYW5kIGhhdmUgdHdvIGh1YnMs IGxvY2F0ZWQgaW4gUGFsbyBBbHRvIGFuZCBBbXN0ZXJkYW0sCnRvIHByb3ZpZGUgdGhyZWF0IGlu dGVsbGlnZW5jZSBzZXJ2aWNlcywgY29udGludW91cyBzdXBwb3J0IGFuZCB0byBvcGVyYXRlCmxv Y2FsIG9mZmljZXMgYW5kIHBhcnRuZXIgbmV0d29yayBzcGFubmluZyAyMCsgY291bnRyaWVzIGFy b3VuZCB0aGUgZ2xvYmUuCgoKCkFkcmVzcyBVU0E6IDIyOCBIYW1pbHRvbiBBdmVudWUsIEZsLiAz LCBQYWxvIEFsdG8sIENBLiA5NDMwMQoKUGhvbmU6IDY1MC43OTguNTI1NQoKVHdpdHRlcjogQGVy cHNjYW4KClNjb29wLWl0OiBCdXNpbmVzcyBBcHBsaWNhdGlvbiBTZWN1cml0eQoKX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KU2VudCB0aHJvdWdoIHRoZSBG dWxsIERpc2Nsb3N1cmUgbWFpbGluZyBsaXN0Cmh0dHBzOi8vbm1hcC5vcmcvbWFpbG1hbi9saXN0 aW5mby9mdWxsZGlzY2xvc3VyZQpXZWIgQXJjaGl2ZXMgJiBSU1M6IGh0dHA6Ly9zZWNsaXN0cy5v cmcvZnVsbGRpc2Nsb3N1cmUv