Oracle E-Business Suite Servlet URL Redirection Vulnerability

[owais.md.khan@xxxxxxxxx]

Oracle E-Business Suite Servlet URL Redirection vulnerability (CVE-2015-2630)

Versions Affected: 11.5.10.2, 12.0.6, 12.1.3

Discussion:
Oracle E-Business Suite is prone to a remote URL-redirection vulnerability. 
This vulnerability may allow a malicious user to perform a phishing attack by 
sending a crafted URL of Oracle E-Business Suite Form Servlet page to another 
user. When an unsuspecting victim follows the URI, they may be redirected to an 
attacker-controlled site; this may aid in phishing attacks.

The vulnerability can be exploited both during an authenticated and 
unauthenticated session as the Form Servlet page is accessible during an 
unauthenticated session as well and user can be tricked using a phishing attack 
to be redirected to malicious website.

Exploit:
An attacker can exploit this issue by enticing an unsuspecting victim into 
following a malicious URI.

Disclosure:
The vulnerability was disclosed to Oracle in March 2015 and is patched in July 
2015 CPU release.

Solution:
Vendor updates are available. Please contact the vendor for more information.

Credit:
Owais Mohammad Khan of National Bank of Kuwait

Contact:
owais.md.khan@xxxxxxxxx