PT-2015-2524 · Oracle · Oracle Application Object Library+2
Alexey Tyurin
+3
·
Published
2015-10-21
·
Updated
2018-12-10
·
CVE-2015-4845
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Oracle E-Business Suite versions 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4
Description
The issue is related to errors in the code of the Oracle Application Object Library component, allowing remote attackers to affect confidentiality. It is also claimed that this issue may allow remote attackers to enumerate database users via a series of requests to
Aoljtest.js. The vulnerability is related to Java APIs - AOL/J.Recommendations
For versions 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4, consider restricting access to the Oracle Application Object Library component until a patch is available.
As a temporary workaround, consider disabling requests to
Aoljtest.js to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability. Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Java
Oracle Application Object Library
Oracle E-Business Suite