CVE-2015-4851

🗓️ 21 Oct 2015 23:00:00Reported by oracleType

cve🔗 web.nvd.nist.gov👁 61 Views🌐 WEB

Unspecified vulnerability in Oracle iSupplier Portal component in E-Business Suite 12.0.6, 12.1.3, 12.2.3, & 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to XML input

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the Oracle E-Business Suite system’s automation functionality allows a perpetrator to gain access to the Oracle iSupplier Portal or execute arbitrary code.	5 Nov 201500:00	–	bdu_fstec
CNVD	Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2015-06835)	22 Oct 201500:00	–	cnvd
Cvelist	CVE-2015-4851	21 Oct 201523:00	–	cvelist
erpscan	Oracle E-Business Suite - XXE injection vulnerability	17 Jul 201500:00	–	erpscan
EUVD	EUVD-2015-4868	7 Oct 202500:30	–	euvd
NVD	CVE-2015-4851	21 Oct 201523:59	–	nvd
Oracle	Oracle Critical Patch Update Advisory - October 2015	20 Oct 201500:00	–	oracle
Tenable Nessus	Oracle E-Business Multiple Vulnerabilities (October 2015 CPU)	21 Oct 201500:00	–	nessus
Prion	Xxe	21 Oct 201523:59	–	prion
securityvulns	[ERPSCAN-15-030] Oracle E-Business Suite - XXE injection Vulnerability	2 Nov 201500:00	–	securityvulns

NVD

Node

oracle e-business_suiteMatch12.0.6

oracle e-business_suiteMatch12.1.3

oracle e-business_suiteMatch12.2.3

oracle e-business_suiteMatch12.2.4

Source	Link
oracle	www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
securityfocus	www.securityfocus.com/bid/77244
securityfocus	www.securityfocus.com/archive/1/536790/100/0/threaded
erpscan	www.erpscan.io/advisories/erpscan-15-030-oracle-e-business-suite-xxe/
securitytracker	www.securitytracker.com/id/1033877
packetstormsecurity	www.packetstormsecurity.com/files/134119/Oracle-E-Business-Suite-12.1.3-XXE-Injection.html
seclists	www.seclists.org/fulldisclosure/2015/Oct/113

Parameter	Position	Path	Description	CWE
XML payload containing DTD	request body	OA_HTML/oramipp_lpr	XML input vulnerability (potential XXE) via crafted XML in request to OA_HTML/oramipp_lpr, may allow reading arbitrary files, denial of service, or SMB relay attacks.	CWE-611
XML input	request body	OA_HTML/oramipp_lpr	XML input vulnerability (potential XXE) via crafted XML in request to OA_HTML/oramipp_lpr, may allow reading arbitrary files, denial of service, or SMB relay attacks.	CWE-611
XML request data	request body	OA_HTML/oramipp_lpr	XML input vulnerability (potential XXE) via crafted XML in request to OA_HTML/oramipp_lpr, may allow reading arbitrary files, denial of service, or SMB relay attacks.	CWE-611

17 Jun 2026 00:28Current

6.2Medium risk

Vulners AI Score6.2

CVSS 26.8

EPSS0.03088