CVE-2015-4886: Medium severity oracle e-business suite vulnerability
Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Reports Security. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, or conduct SMB Relay attacks via a crafted DTD in an XML request involving the OAHTML/copxml servlet.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4886?
CVE-2015-4886 has not been assigned a specific CVSS score, but it poses a significant risk to confidentiality and integrity in affected Oracle E-Business Suite versions.
How do I fix CVE-2015-4886?
To mitigate CVE-2015-4886, it is recommended to update to the latest patched version of Oracle E-Business Suite provided by Oracle.
Which versions of Oracle E-Business Suite are affected by CVE-2015-4886?
CVE-2015-4886 affects Oracle E-Business Suite versions 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4.
What type of attacks can be conducted using CVE-2015-4886?
CVE-2015-4886 can be exploited by remote attackers to compromise the confidentiality and integrity of data within the Oracle Report Manager component.
Is there a workaround for CVE-2015-4886?
No specific workaround is documented for CVE-2015-4886, and the best approach is to upgrade to a secure version as per Oracle's recommendations.