Web Security Risk: Injection Link Possible (Doc ID 1447320.1)

Last updated on OCTOBER 19, 2016

Applies to:

LODESTAR EIP - Version 1.5.0 and later
Information in this document applies to any platform.

Symptoms


=== ODM Issue Clarification ===
A security audit on the website has uncovered a high security risk: it is possible on some standard pages to inject a link in the request (called "Injection link" risk).
For example on url: https://intcdm.grtgaz.com/lodestar/Classic/DataTools/genoptions/intervaldata.asp using parameter UserLevel

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms