CVE-2008-5446 - Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite

CVE-2008-5446

Summary

Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is related to unrestricted guest access to the "About Us Page" in the Oracle Applications Framework (OAF), which allows attackers to obtain sensitive system and application environment information.

References

Vulnerable Configurations

cpe:2.3:a:oracle:e-business_suite:11.5:cu2:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5:cu2:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite_12:12.0.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite_12:12.0.6:*:*:*:*:*:*:*

CVSS

Base:	3.5 (as of 11-10-2018 - 20:55)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	SINGLE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:M/Au:S/C:P/I:N/A:N

refmap via4

bid	33177
bugtraq	20090118 Advisory: Oracle EBusiness Suite Sensitive Information Disclosure Vulnerability
confirm	http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html
misc	http://secniche.org/papers/orabs.pdf
sectrack	1021568
secunia	33525
vupen	ADV-2009-0115

saint via4

bid 33177
description Oracle WebLogic Server IIS Connector JSESSIONID buffer overflow
title weblogic_iis_connector_jsessionid
type remote
bid 33177
description Oracle Database OLAP component ODCITABLESTART buffer overflow
id database_oracle_version
osvdb 51347
title oracle_olap_odcitablestart
type remote
bid 33177
description Oracle Secure Backup login.php ora_osb_lcookie command execution
id database_oracle_backupver
osvdb 51343
title oracle_secure_backup_login_lcookie
type remote
bid 33177
description Oracle Secure Backup login.php rbtool command injection
id database_oracle_backupver
osvdb 51342
title oracle_secure_backup_login_rbtool
type remote

bid	33177
description	Oracle Secure Backup NDMP_CONECT_CLIENT_AUTH buffer overflow
id	database_oracle_backupndmpbo,database_oracle_backupver
osvdb	51340
title	oracle_secure_backup_ndmp_clientauth
type	remote

Last major update

11-10-2018 - 20:55

Published

14-01-2009 - 02:30

Last modified

11-10-2018 - 20:55