Unscored severity · published Apr 1, 2002
CVE-2002-1640
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to inject arbitrary web script or HTML via…
–
CVSS
5.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to inject arbitrary web script or HTML via (1) Text Features in the DHTML UI or (2) the test parameter to the oracle.apps.cz.servlet.UiServlet servlet.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Configurator · Oracle
11.5.6.0.0 through 11.5.6.16.52; 11.5.7.0.0 through 11.5.7.17.31; 11i · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1640
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1640
Exploit
http://securitytracker.com/id?1003967
Patch
http://www.oracle.com/technology//deploy/security/htdocs/oconfigvul.html
Third Party Advisory
http://www.securityfocus.com/bid/4430
Third Party Advisory
http://www.securityfocus.com/bid/4436
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/8780
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/8781
More from Configurator
7.5
CVE-2025-61884
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
8.2
CVE-2021-2080
Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet)
8.2
CVE-2021-2079
Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet)
8.2
CVE-2021-2078
Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet)
8.2
CVE-2020-14669
Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet)