Oracle E-Business Multiple Vulnerabilities (Oct 2018 CPU)

The version of Oracle E-Business installed on the remote host is missing the October 2018 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory : - An unspecified vulnerability in the Oracle Trade...

CVE-2018-3138

CVE-2018-3138 affects Oracle E-Business Suite’s Oracle Application Object Library (AOL), specifically the Attachments / File Upload subcomponent. Affected versions include 12.1.3 and 12.2.x (12.2.3–12.2.7). The vulnerability allows unauthenticated, network-based access via HTTP to AOL, with explo...