CVE-2015-4854

Vulnerability

The Oracle Application Object Library component in Oracle E-Business Suite versions 12.0.6, 12.1.3, 12.2.3, and 12.2.4 contains a cross-site scripting (XSS) vulnerability in the CfgOCIReturn servlet [1]. The issue stems from insufficient sanitization of the Domain parameter, allowing injection of arbitrary web script or HTML [1]. Oracle's October 2015 Critical Patch Update (CPU) addresses this unspecified vulnerability, though external researchers have identified it as stored/reflected XSS [1].

Exploitation

An unauthenticated remote attacker can craft a malicious URL containing specially crafted JavaScript in the Domain parameter of the CfgOCIReturn servlet [1]. When a victim user clicks the link, the injected script executes in the context of the Oracle E-Business Suite session, without requiring any prior authentication [1]. The attack complexity is medium, as it requires user interaction to follow the crafted link [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, leading to potential impersonation and information disclosure [1]. The attacker can perform actions on behalf of the victim, access sensitive data, or redirect the user to malicious sites. The CVSS score is 4.3 (Medium) with partial integrity impact and no impact on confidentiality or availability [1].

Mitigation

Oracle released a fix in the CPU of October 2015 [1]. Affected organizations should apply the patch corresponding to their Oracle E-Business Suite version (12.0.6, 12.1.3, 12.2.3, or 12.2.4). No workaround is provided in the public advisories.