Cross-Site-Scripting Vulnerabilitiy in Oracle APEX NOTIFICATION_MSG
The parameter NOTIFCATION_MSG parameter contains a cross site scripting vulnerability.
Oracle APEX/HTMLDB < 2.2.1
This bug is fixed with the patch 2.2.1 of APEX which is not part of the Critical Patch Update October 2006. It's necessary to upgrade your APEX/HTMLDB installation to 2.2.1. Patches are currently not available for Oracle Application Express.
03-oct-2005 Oracle secalert was informed
04-oct-2005 Bug confirmed
17-oct-2006 Oracle published CPU October 2006
18-oct-2006 Red-Database-Security published this advisory
23-oct-2006 CVE added
© 2006 by Red-Database-Security GmbH - last update 23-oct-2006