CVE:CVE-2008-0869
CNNVD:CNNVD-200802-393
BEA WebLogic Workshop存在跨站脚本攻击漏洞。远程攻击者通过在运行WebLogic Workshop 或 Apache Beehive NetUI 框架页面流(framework page flows)时候的一个"框架定义请求参数"("framework defined request parameter")来注入任意Web脚本或HTML。
solution:Upgrade bea weblogic_server to a higher version than 9.0,9.1,9.2,and avoid the version 9.0,9.1,9.2; Upgrade bea weblogic_workshop to a higher version than 8.1:sp2,8.1:sp3,8.1:sp4,8.1:sp5,8.1:sp6,and avoid the version 8.1:sp2,8.1:sp3,8.1:sp4,8.1:sp5,8.1:sp6; Upgrade bea_systems weblogic to a higher version than 10.0,and avoid the version 10.0