CVE-2016-3438 : Unspecified vulnerability in the Oracle Configurator component in Oracle Supply

Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to JRAD Heartbeat. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that that this issue involves multiple cross-site scripting (XSS) vulnerabilities, which allow remote attackers to inject arbitrary web script or HTML via three unspecified parameters in an unknown JSP file.

Published 2016-04-21 11:00:29

Updated 2025-04-12 10:46:41

Source Oracle

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2016-3438

Oracle » Configurator » Version: 12.2
cpe:2.3:a:oracle:configurator:12.2:*:*:*:*:*:*:*
Matching versions
Oracle » Configurator » Version: 12.1
cpe:2.3:a:oracle:configurator:12.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-3438

EPSS FAQ

0.33%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-3438

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:P/A:N	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
8.2	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N	2.8	4.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: High Integrity: Low Availability: None

References for CVE-2016-3438

http://seclists.org/fulldisclosure/2016/Aug/136

Full Disclosure: Onapsis Security Advisory ONAPSIS-2016-018: Oracle E-Business Suite Cross Site Scripting (XSS) CVE-2016-3438
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

cpuapr2016v3
Vendor Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1035591

Oracle Supply Chain Products Suite Bugs Let Remote and Local Users Access and Modify Data and Deny Service - SecurityTracker

CVEs referencing this url
http://packetstormsecurity.com/files/138564/Oracle-E-Business-Suite-12.2-Cross-Site-Scripting.html

Oracle E-Business Suite 12.2 Cross Site Scripting ≈ Packet Storm
http://onapsis.com/research/security-advisories/oracle-e-business-suite-cross-site-scripting-xss-cve-2016-3438

Oracle E-Business Suite Cross Site Scripting (XSS) CVE-2016-3438 | Onapsis

Jump to

Vulnerability Details : CVE-2016-3438

Products affected by CVE-2016-3438

Exploit prediction scoring system (EPSS) score for CVE-2016-3438

CVSS scores for CVE-2016-3438

References for CVE-2016-3438