CVE-2017-3528

MEDIUM NUCLEI

Oracle E-Business Suite 12.1.3-12.2.6 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-3528. PoCs published by Andrew Gill. A Nuclei detection template is also available.

AI-analyzed exploit summary The exploit describes an open redirect vulnerability in Oracle E-Business Suite, where the 'redirect' parameter in a specific URL path can be manipulated to redirect users to arbitrary domains. The provided example demonstrates the vulnerability but does not include executable code.

Description

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).

Exploits (1)

exploitdb WRITEUP VERIFIED
by Andrew Gill · textwebappsjsp
https://www.exploit-db.com/exploits/43592

The exploit describes an open redirect vulnerability in Oracle E-Business Suite, where the 'redirect' parameter in a specific URL path can be manipulated to redirect users to arbitrary domains. The provided example demonstrates the vulnerability but does not include executable code.

Classification
Writeup 90%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: Oracle E-Business Suite (version not specified)
No auth needed
Prerequisites: Access to the vulnerable Oracle E-Business Suite instance · Ability to craft a malicious URL with the 'redirect' parameter
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
MEDIUMby 0x_Akoko

References (4)

Core 4
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43592/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/97780
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038299

Scores

CVSS v3 5.4
EPSS 0.1456
EPSS Percentile 96.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (10)
oracle/applications_framework 12.1.3
oracle/applications_framework 12.2.3
oracle/applications_framework 12.2.4
oracle/applications_framework 12.2.5
oracle/applications_framework 12.2.6
Oracle Corporation/Applications Framework 12.1.3
Oracle Corporation/Applications Framework 12.2.3
Oracle Corporation/Applications Framework 12.2.4
Oracle Corporation/Applications Framework 12.2.5
Oracle Corporation/Applications Framework 12.2.6
Published Apr 24, 2017
Tracked Since Feb 18, 2026