CVE-2018-3167

MEDIUMNuclei

Oracle E-Business Suite - Blind SSRF

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-3167 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.

Description

Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monitoring). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Management Pack for Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Application Management Pack for Oracle E-Business Suite accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 2, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Application Management Pack for Oracle E-Business Suite

Browse Oracle Corporation / Application Management Pack for Oracle E-Business Suite
CVE List12.1.3affected
12.2.3affected
12.2.4affected
12.2.5affected
12.2.6affected
12.2.7affected

Nuclei templates

1
ProjectDiscoveryMEDIUMOracle E-Business Suite - Blind SSRFCVSS 5.3

Oracle E-Business Suite, Application Management Pack component (User Monitoring subcomponent), is susceptible to blind server-side request forgery. An attacker with network access via HTTP can gain read access to a subset of data, connect to internal services like HTTP-enabled databases, or perform post requests towards internal services which are not intended to be exposed. Affected supported versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7.

Impact

Successful exploitation of this vulnerability could allow an attacker to bypass network restrictions and access internal resources.

Remediation

Apply the necessary patches or updates provided by Oracle to mitigate this vulnerability.

Authorsgeeknik
Template tagscvecve2018oracleebsssrfblinde-business_suitevuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CPE: cpe:2.3:a:oracle:application_management_pack:12.1.3:*:*:*:*:e-business_suite:*:*
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://web.archive.org/web/20211206102649/https://securitytracker.com/id/1041897 https://medium.com/@x41x41x41/unauthenticated-ssrf-in-oracle-ebs-765bd789a145 https://nvd.nist.gov/vuln/detail/CVE-2018-3167 http://www.securitytracker.com/id/1041897

Source: ProjectDiscovery

References

4