Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2020-9314

CWE-79 — Cross-site Scripting (XSS)CWE-745 documents5 sources

Severity

4.8MEDIUM

EPSS

12.0%

top 6.22%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Oracle Iplanet WEB Server

Timeline

PublishedMay 10

Latest updateMay 24

Description

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages1 packages

▶NVDoracle/iplanet_web_server7.0 — 7.0.27

🔴Vulnerability Details

GHSA

GHSA-8fc5-c477-8j2w: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7↗2022-05-24

▶

CVEList

CVE-2020-9314: ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7↗2020-05-10

▶

VulnCheck

Oracle iplanet_web_server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')↗2020

▶

💥Exploits & PoCs

Nuclei

Oracle iPlanet Web Server 7.0.x - Image Injection

▶