PT-2015-2524 · Oracle · Oracle Application Object Library+2
Alexey Tyurin
+3
·
Publicado
2015-10-21
·
Atualizado
2018-12-10
·
CVE-2015-4845
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Oracle E-Business Suite versions 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4
Description
The issue is related to errors in the code of the Oracle Application Object Library component, allowing remote attackers to affect confidentiality. It is also claimed that this issue may allow remote attackers to enumerate database users via a series of requests to
Aoljtest.js. The vulnerability is related to Java APIs - AOL/J.Recommendations
For versions 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4, consider restricting access to the Oracle Application Object Library component until a patch is available.
As a temporary workaround, consider disabling requests to
Aoljtest.js to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability. Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Java
Oracle Application Object Library
Oracle E-Business Suite