Oracle E-Business Suite 12.0.3 Oracle Application Object Library Privilege Escalation
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
5.7 | $0-$5k | 0.00 |
A vulnerability classified as critical has been found in Oracle E-Business Suite 12.0.3 (Supply Chain Management Software). This affects an unknown code block of the component Oracle Application Object Library. The manipulation with an unknown input leads to a privilege escalation vulnerability. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:
Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.3 allow (1) local users to affect confidentiality and integrity via unknown vectors related to the Mobile Application Server component (APP01); (2) remote attackers to affect confidentiality via unknown vectors related to the Oracle Applications Framework (APP03); remote authenticated users to affect confidentiality and integrity via unknown vectors related to the (3) CRM Technical Foundation (APP05) and (4) Oracle Application Object Library (APP06); and remote authenticated users to affect integrity and availability via unknown vectors related to (5) Oracle Applications Technology Stack (APP07).
The weakness was presented 01/16/2008 by Alexander Kornbrust with Application Security, Inc. (Website). The advisory is shared at us-cert.gov. This vulnerability is uniquely identified as CVE-2008-7238 since 09/14/2009. It is possible to initiate the attack remotely. The requirement for exploitation is a authentication. Technical details are unknown but a public exploit is available.
A public exploit has been developed in SQL. The exploit is shared for download at securityfocus.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k.
Applying a patch is able to eliminate this problem.
See 40615, 40614, 40613 and 40612 for similar entries.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.3VulDB Meta Temp Score: 5.7
VulDB Base Score: 6.3
VulDB Temp Score: 5.7
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Privilege EscalationCWE: Unknown
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Programming Language: 🔍
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔍
Timeline
01/10/2008 🔍01/10/2008 🔍
01/16/2008 🔍
01/16/2008 🔍
09/14/2009 🔍
09/14/2009 🔍
03/18/2015 🔍
12/19/2017 🔍
Sources
Vendor: oracle.comAdvisory: us-cert.gov
Researcher: Alexander Kornbrust
Organization: Application Security, Inc.
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2008-7238 (🔍)
SecurityTracker: 1019218
SecurityFocus: 27229 - Oracle January 2008 Critical Patch Update Multiple Vulnerabilities
Secunia: 28518
OSVDB: 40284 - Oracle E-Business Suite Mobile Application Server Unspecified Remote Issue
Vupen: ADV-2008-0150
scip Labs: https://www.scip.ch/en/?labs.20161013
See also: 🔍
Entry
Created: 03/18/2015 15:15Updated: 12/19/2017 09:38
Changes: 03/18/2015 15:15 (66), 12/19/2017 09:38 (1)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.