Description

Oracle EBS "Popup windows" subcomponent allows a remote attacker to control the source of the frame. It can be used for phishing attacks.

Remediation

Upgrade to the latest version of Oracle E-Business Suite

References

Oracle Critical Patch Update Advisory - April 2017

Related Vulnerabilities

Java object deserialization of user-supplied data

Weak WordPress security key

WordPress XML-RPC authentication brute force

Tornado weak secret key

CouchDB REST API publicly accessible

Severity

Medium

Classification

CVE-2017-3528 CWE-601 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Configuration