CVE

Id
86753  
CVE No.
CVE-2016-0457  
Status
Candidate  
Description
Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0456. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/lcmServiceController.jsp.  
Phase
Assigned (20151209)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
759732 86753 CVE-2016-0457 MISC:https://erpscan.com/advisories/erpscan-16-007-oracle-e-business-suite-xxe-injection-vulnerability/  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
419 JVNDB-2016-001192 Oracle E-Business Suite の Oracle E-Business Intelligence における Common Components に関する脆弱性 Oracle E-Business Suite の Oracle E-Business Intelligence には、Common Components に関する処理に不備があるため、機密性、および完全性に影響のある脆弱性が存在します。 CVE-2016-0549 86753 6.4 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001192.html  View