PT-2003-1762 · Oracle · Oracle E-Business Suite

Stephen Kost · Published 2003-08-02 · Updated 2016-10-18 · CVE-2003-0633

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 11.5.1 through 11.5.8

Description: The issue allows a remote attacker to obtain sensitive information without authentication, including the GUEST user password and the application server security key, due to multiple vulnerabilities in the aoljtest.jsp of Oracle Applications AOL/J Setup Test Suite.

Recommendations: For Oracle E-Business Suite versions 11.5.1 through 11.5.8, consider restricting access to the aoljtest.jsp page until a fix is available. As a temporary workaround, limit the exposure of sensitive information by implementing additional authentication measures for accessing the GUEST user password and the application server security key. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-0633

Affected Products

Oracle E-Business Suite

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2003-0633 · Security Note
• http://marc.info/?l=bugtraq&m=105906689120237&w=2 · Note
• http://otn.oracle.com/deploy/security/pdf/2003alert55.pdf · Note
• http://securityfocus.com/bid/8268 · Note