Oracle E-Business Suite Servlet URL Redirection vulnerability (CVE-2015-2630)

Versions Affected: 11.5.10.2, 12.0.6, 12.1.3

Discussion:
Oracle E-Business Suite is prone to a remote URL-redirection vulnerability. This vulnerability may allow a malicious user to perform a phishing attack by sending a crafted URL of Oracle E-Business Suite Form Servlet page to another user. When an unsuspecting victim follows the URI, they may be redirected to an attacker-controlled site; this may aid in phishing attacks.

The vulnerability can be exploited both during an authenticated and unauthenticated session as the Form Servlet page is accessible during an unauthenticated session as well and user can be tricked using a phishing attack to be redirected to malicious website.

Exploit:
An attacker can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Disclosure:
The vulnerability was disclosed to Oracle in March 2015 and is patched in July 2015 CPU release.

Solution:
Vendor updates are available. Please contact the vendor for more information.

Credit:
Owais Mohammad Khan of National Bank of Kuwait

Contact:
owais.md.khan@gmail.com