Will, > To exploit this an admin user still needs to click on a link > to a URL right? or is the malicious javascript inserted into > the login page via http splitting? An attacker needs to either trick the admin to visit some web page, or modify the response of any web server the admin ever connects to (e.g., Google). What's important is that he can do this any time _before_ the admin logs in to WebLogic console, not during an already active administration session. This makes the attack very easy, at least from my pen-testing perspective. Sorry for the delay in replying. Mitja Kolsek ACROS, d.o.o. Makedonska ulica 113 SI - 2000 Maribor, Slovenia tel: +386 2 3000 280 fax: +386 2 3000 282 web: http://www.acrossecurity.com
