CVE-2015-4854
- State
- Published
- Severity
- Not scored
- Published
- Oct 21, 2015
- Updated
- Aug 6, 2024
- Reserved
- Jun 24, 2015
Description
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Single Signon. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML via the Domain parameter in the CfgOCIReturn servlet.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 1033877vdb-entry
- 20151027 [ERPSCAN-15-027] Oracle E-Business Suite - Cross Site Scripting Vulnerabilitymailing-list
- https://erpscan.io/advisories/erpscan-15-027-oracle-e-business-suite-cross-site-scripting-vulnerability/
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- 77253vdb-entry
- 20151027 [ERPSCAN-15-027] Oracle E-Business Suite - Cross Site Scripting Vulnerabilitymailing-list
- http://packetstormsecurity.com/files/134100/Oracle-E-Business-Suite-12.1.4-Cross-Site-Scripting.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.