PT-2016-5552 · Oracle · Oracle Knowledge Management+1

Published 2016-07-21 · Updated 2017-09-01 · CVE-2016-3533

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Oracle E-Business Suite versions 12.2.3 through 12.2.5

Description The issue affects the integrity of the system via vectors related to Search in the Oracle Knowledge Management component. It is claimed by third parties to involve multiple open redirect vulnerabilities, which could allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks.

Recommendations For Oracle E-Business Suite versions 12.1.1 through 12.1.3, apply the July 2016 CPU patch to resolve the issue. For Oracle E-Business Suite versions 12.2.3 through 12.2.5, apply the July 2016 CPU patch to resolve the issue. As a temporary workaround, consider restricting access to the Search function in the Oracle Knowledge Management component until a patch is applied.

Fix

Related Identifiers

CVE-2016-3533

Affected Products

Oracle E-Business Suite

Oracle Knowledge Management

References · 7

• http://oracle.com/technetwork/security-advisory/cpujul2016-2881720.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3533 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3533 · Vendor Advisory
• http://securityfocus.com/bid/91909 · Note
• http://securitytracker.com/id/1036403 · Note
• https://onapsis.com/blog/oracle-fixes-record-276-vulnerabilities-july-2016 · Note
• http://securityfocus.com/bid/91787 · Note