CVE-2016-3535 — Cross-site Scripting in Oracle CRM Technical Foundation

3 documents3 sources
Severity
8.2HIGHNVD
EPSS
0.9%
top 24.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Oracle CRM Technical Foundation
Timeline
PublishedJul 21
Latest updateMay 17

Description

Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Remote Launch. NOTE: the previous information is from the July 2016 CPU. Oracle has not commented on third-party claims that this issue is a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NExploitability: 2.8 | Impact: 4.7

Affected Packages1 packages

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-jvhf-84cx-qrj2: Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 12↗2022-05-17
▶
CVEList
CVE-2016-3535: Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 12↗2016-07-21
▶
CVE-2016-3535 — Cross-site Scripting in Oracle | cvebase