CVE-2015-4854 — Cross-site Scripting in Oracle E-business Suite

3 documents3 sources

Severity

4.3MEDIUMNVD

EPSS

0.6%

top 31.64%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Oracle E-business Suite

Timeline

PublishedOct 21

Latest updateMay 14

Description

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Single Signon. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML via the Domain parameter in the…

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDoracle/e-business_suite4 versions+3

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

GHSA

GHSA-6jfm-9vp3-447r: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12↗2022-05-14

▶

CVEList

CVE-2015-4854: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12↗2015-10-21

▶