Vulnerability Details : CVE-2016-3438
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to JRAD Heartbeat. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that that this issue involves multiple cross-site scripting (XSS) vulnerabilities, which allow remote attackers to inject arbitrary web script or HTML via three unspecified parameters in an unknown JSP file.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2016-3438
- cpe:2.3:a:oracle:configurator:12.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:configurator:12.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-3438
0.33%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 53 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-3438
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:P/A:N |
10.0
|
4.9
|
NIST | |
8.2
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N |
2.8
|
4.7
|
NIST |
References for CVE-2016-3438
-
http://seclists.org/fulldisclosure/2016/Aug/136
Full Disclosure: Onapsis Security Advisory ONAPSIS-2016-018: Oracle E-Business Suite Cross Site Scripting (XSS) CVE-2016-3438
-
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
cpuapr2016v3Vendor Advisory
-
http://www.securitytracker.com/id/1035591
Oracle Supply Chain Products Suite Bugs Let Remote and Local Users Access and Modify Data and Deny Service - SecurityTracker
-
http://packetstormsecurity.com/files/138564/Oracle-E-Business-Suite-12.2-Cross-Site-Scripting.html
Oracle E-Business Suite 12.2 Cross Site Scripting ≈ Packet Storm
-
http://onapsis.com/research/security-advisories/oracle-e-business-suite-cross-site-scripting-xss-cve-2016-3438
Oracle E-Business Suite Cross Site Scripting (XSS) CVE-2016-3438 | Onapsis
Jump to