CVE:CVE-2008-2751
CNNVD:CNNVD-200806-251
Sun Java System 应用程序服务器9.1_01版本中的Glassfish webadmin界面存在多个跨站脚本漏洞。远程攻击者可以借助到(a)resourceNode/customResourceNew.jsf的(1)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew,(2)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType,(3)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass,或(4)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc参数；到(b)resourceNode/externalResourceNew.jsfthe的(5)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew,(6)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType,(7)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass,(8)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup,或(9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc参数；到(c)resourceNode/jmsDestinationNew.jsf的(10)propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi,(11)propertyForm:propertySheet:propertSectionTextField:nameProp:name,或(12)propertyForm:propertySheet:propertSectionTextField:descProp:desc参数；到(d)resourceNode/jmsConnectionNew.jsf的(13)propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi或(14)propertyForm:propertySheet:generalPropertySheet:descProp:cd 参数；到(e)resourceNode/jdbcResourceNew.jsf的(15)propertyForm:propertySheet:propertSectionTextField:jndiProp:jnditext或(16)propertyForm:propertySheet:propertSectionTextField:descProp:desc参数；到(f)applications/lifecycleModulesNew.jsf的(17)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name,(18)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname,或(19)propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder参数；到(g)resourceNode/jdbcConnectionPoolNew1.jsf的(20)propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name,(21)propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType,或(22)propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db参数，注入任意的web脚本或HTML。
solution:Upgrade oracle glassfish_server to a higher version than 1.0,1.0:ur1,1.0:ur1_po1,2.0,2.1,2.1.1,3.0,3.0.1,and avoid the version 1.0,1.0:ur1,1.0:ur1_po1,2.0,2.1,2.1.1,3.0,3.0.1; Upgrade sun java_system_application_server to a higher version than 9.1_01,and avoid the version 9.1_01