CVE-2017-3528

MEDIUMNuclei

Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-3528 has a selected CVSS score of 5.4 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 7, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Applications Framework

Browse Oracle Corporation / Applications Framework
CVE List12.1.3affected
12.2.3affected
12.2.4affected
12.2.5affected
12.2.6affected

Proofs of concept

1

Catalogued exploits

ExploitDBOracle E-Business Suite 12.1.3/12.2.x - Open RedirectExploitDB exploitby Andrew GillNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMOracle E-Business Suite 12.1.3/12.2.x - Open RedirectCVSS 5.4

The Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)) is impacted by open redirect issues in versions 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. These easily exploitable vulnerabilities allow unauthenticated attackers with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data.

Impact

Attackers can redirect users to malicious sites for phishing attacks, malware distribution, or credential theft.

Remediation

Apply the necessary patches or updates provided by Oracle to fix the open redirect vulnerability.

WeaknessesCWE-601
Authors0x_Akoko
Template tagscvecve2017oracleredirectedbvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CPE: cpe:2.3:a:oracle:applications_framework:12.1.3:*:*:*:*:*:*:*
https://blog.zsec.uk/cve-2017-3528/ https://www.exploit-db.com/exploits/43592 https://nvd.nist.gov/vuln/detail/CVE-2017-3528 http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html http://www.securitytracker.com/id/1038299

Source: ProjectDiscovery

References

5