6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.009 Low
EPSS
Percentile
82.6%
Application: E-Business Suite Vendor URL:Oracle **Bugs:**XXE injection **Reported:**17.07.2015 **Vendor response:**24.07.2015 **Date of Public Advisory:**20.10.2015 Reference:Oracle CPU Oct 2015 Authors: Nikita Kelesis, Ivan Chalykin, Alexey Tyurin (ERPScan)
VULNERABILITY INFORMATION
Class: XML External Entity [CWE-611]
Impact: information disclosure, DoS, SSRF, NTLM relay
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2015-4851
CVSS Information
CVSS Base Score: 6.8 / 10
CVSS Base Vector:
AV : Access Vector (Related exploit range) | Network (N) |
---|---|
AC : Access Complexity (Required attack complexity) | Medium (M) |
Au : Authentication (Level of authentication needed to exploit) | None (N) |
C : Impact to Confidentiality | Partial (P) |
I : Impact to Integrity | Partial (P) |
A : Impact to Availability | Partial (P) |
Business Risk
The attacker can read an arbitrary file on the server by sending a correct XML request with a crafted DTD to read the reply from the service.
The attacker can perform a DoS attack (for example, an XML Entity Expansion attack).
An SMB Relay attack is a type of Man-in-the-Middle attack where the attacker asks the victim to authenticate into a machine controlled by the attacker, then relays the credentials to the target. The attacker forwards the authentication information both ways and gets access.
Description
Oracle XML parser validates all incoming XML requests with a user-specified DTD.
VULNERABLE PACKAGES
Oracle E-Business Suite 12.1.3
Other versions are probably affected too, but they were not checked.
SOLUTIONS AND WORKAROUNDS
Install Oracle CPU October 2015
TECHNICAL DESCRIPTION
Vulnerable servlet:
/OA_HTML/oramipp_lpr