PT-2003-1762 · Oracle · Oracle E-Business Suite

Stephen Kost · Publicado 2003-08-02 · Atualizado 2016-10-18 · CVE-2003-0633

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 11.5.1 through 11.5.8

Description: The issue allows a remote attacker to obtain sensitive information without authentication, including the GUEST user password and the application server security key, due to multiple vulnerabilities in the aoljtest.jsp of Oracle Applications AOL/J Setup Test Suite.

Recommendations: For Oracle E-Business Suite versions 11.5.1 through 11.5.8, consider restricting access to the aoljtest.jsp page until a fix is available. As a temporary workaround, limit the exposure of sensitive information by implementing additional authentication measures for accessing the GUEST user password and the application server security key. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2003-0633

Produtos afetados

Oracle E-Business Suite

Referências · 4

• http://marc.info/?l=bugtraq&m=105906689120237&w=2 · Nota
• http://otn.oracle.com/deploy/security/pdf/2003alert55.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0633 · Nota de Segurança
• http://securityfocus.com/bid/8268 · Nota