VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 28, 2005· Updated Jun 16, 2026

CVE-2005-4549

CVE-2005-4549

Description

Cross-site scripting (XSS) vulnerability in Oracle Application Server (OracleAS) Discussion Forum Portlet allows remote attackers to inject arbitrary web script or HTML via the (1) RowKeyValue parameter in the PORTAL schema; and the (2) title and (3) content input fields when creating an forum article.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

Patches

Vulnerability mechanics

Root cause

"Missing input validation and output encoding in the OracleAS Discussion Forum Portlet allows injection of arbitrary HTML and JavaScript."

Attack vector

Two attack vectors exist. First, a reflected XSS: an attacker crafts a malicious URL containing JavaScript in the "RowKeyValue" parameter and tricks a victim into clicking it, causing the script to execute temporarily [ref_id=1][ref_id=2]. Second, a stored XSS: an attacker posts a forum article with malicious script in the title or content fields; any user who views the article (or even just the overview page if the title is crafted to hide the article) will execute the stored script, enabling session cookie theft or other client-side attacks [ref_id=1][ref_id=2]. No authentication is required to trigger either vector [ref_id=2].

Affected code

The advisory identifies the OracleAS Discussion Forum Portlet (version of May 2005) as the vulnerable component [ref_id=1][ref_id=2]. The URL parameter "RowKeyValue" in the PORTAL schema is not validated, and the title and content input fields when creating a forum article lack any filtering [ref_id=1][ref_id=2]. No patch or source code is provided in the bundle, so specific function names or file paths are not available.

What the fix does

No patch is available in the bundle. The advisory states that Oracle acknowledged the issue in September 2005 and indicated a fix would be provided within four weeks, but no patch was released before the advisory was published [ref_id=1][ref_id=2]. Oracle's response characterized the forum portlet as sample code not intended for production use, and the advisory's recommended remediation is to use the forum portlet only in test installations and not in a production environment [ref_id=1][ref_id=2].

Preconditions

  • inputThe attacker must be able to craft a URL with a malicious RowKeyValue parameter (reflected XSS) or post a forum article (stored XSS).
  • networkA victim must click the crafted URL (reflected) or view the malicious article/overview page (stored).
  • authNo authentication is required for the attacker to craft the payload.

Reproduction

**Reflected XSS:** Request a URL such as `http://$host/portal/page?_pageid=XXX,XXX&_dad=portal&_schema=PORTAL&df_next_page=htdocs/forums.jsp&RowKeyValue=

Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.