PT-2016-5555 · Oracle · Oracle E-Business Suite

Published 2016-07-21 · Updated 2017-09-01 · CVE-2016-3536

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3

Description The issue affects confidentiality and integrity, and it is related to the Deliverables in the Oracle Marketing component. There are claims that this issue involves multiple cross-site scripting (XSS) vulnerabilities, which allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Recommendations For Oracle E-Business Suite versions 12.1.1 through 12.1.3, apply the July 2016 CPU patch to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific issue.

Fix

Related Identifiers

CVE-2016-3536

Affected Products

Oracle E-Business Suite

References · 7

• http://oracle.com/technetwork/security-advisory/cpujul2016-2881720.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3536 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3536 · Vendor Advisory
• http://securityfocus.com/bid/91857 · Note
• http://securitytracker.com/id/1036403 · Note
• https://onapsis.com/blog/oracle-fixes-record-276-vulnerabilities-july-2016 · Note
• http://securityfocus.com/bid/91787 · Note