nuclei-templates/cves/2017/CVE-2017-3528.yaml

id: CVE-2017-3528

info:
  name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
  author: 0x_Akoko
  severity: medium
  reference:
    - https://blog.zsec.uk/cve-2017-3528/
    - https://www.exploit-db.com/exploits/43592
  tags: cve,cve2017,oracle,redirect
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.40
    cve-id: CVE-2017-3528
    cwe-id: CWE-601
  description: "Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)."

requests:
  - method: GET
    path:
      - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"

    matchers:
      - type: word
        words:
          - 'noresize src="/\example.com?configName='
        part: body
misc updates 2021-05-31 11:23:36 +00:00			`id: CVE-2017-3528`

			`info:`
			`name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect`
			`author: 0x_Akoko`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`severity: medium`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
Satisfying the linter (all errors and warnings) * whitespace modifications only 2021-08-19 14:44:46 +00:00			`- https://blog.zsec.uk/cve-2017-3528/`
			`- https://www.exploit-db.com/exploits/43592`
Added missing cve tags 2021-09-21 10:47:16 +00:00			`tags: cve,cve2017,oracle,redirect`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N`
			`cvss-score: 5.40`
			`cve-id: CVE-2017-3528`
			`cwe-id: CWE-601`
			description: "Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)."
misc updates 2021-05-31 11:23:36 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"`

			`matchers:`
			`- type: word`
			`words:`
			`- 'noresize src="/\example.com?configName='`
			`part: body`