CVE Vulnerability

CVE-2008-5446

Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is related to unrestricted guest access to the "About Us Page" in the Oracle Applications Framework (OAF), which allows attackers to obtain sensitive system and application environment information.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

References
Link Resource
http://secniche.org/papers/orabs.pdf
http://secunia.com/advisories/33525 Vendor Advisory
http://www.securityfocus.com/bid/33177 Exploit
http://www.securitytracker.com/id?1021568
http://www.vupen.com/english/advisories/2009/0115 Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html
http://www.securityfocus.com/archive/1/500171/100/0/threaded
Configurations

Configuration 1

cpe:2.3:a:oracle:e-business_suite_12:12.0.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:e-business_suite:11.5:cu2:*:*:*:*:*:*
Information

Published : 2009-01-14 02:30

Updated : 2018-10-11 08:55

NVD link : CVE-2008-5446

Mitre link : CVE-2008-5446

Products Affected
No products.
CWE
NVD-CWE-noinfo