CVE-2017-3528

MEDIUM NUCLEI

Oracle E-Business Suite 12.1.3-12.2.6 - RCE

Title source: llm
STIX 2.1

Description

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).

Exploits (1)

exploitdb WRITEUP VERIFIED
by Andrew Gill · textwebappsjsp
https://www.exploit-db.com/exploits/43592

Nuclei Templates (1)

Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
MEDIUMby 0x_Akoko

References (4)

Core 4
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43592/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/97780
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038299

Scores

CVSS v3 5.4
EPSS 0.4324
EPSS Percentile 97.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (10)
oracle/applications_framework 12.1.3
oracle/applications_framework 12.2.3
oracle/applications_framework 12.2.4
oracle/applications_framework 12.2.5
oracle/applications_framework 12.2.6
Oracle Corporation/Applications Framework 12.1.3
Oracle Corporation/Applications Framework 12.2.3
Oracle Corporation/Applications Framework 12.2.4
Oracle Corporation/Applications Framework 12.2.5
Oracle Corporation/Applications Framework 12.2.6
Published Apr 24, 2017
Tracked Since Feb 18, 2026