漏洞描述
Oracle E-Business Suite, Application Management Pack component (User Monitoring subcomponent), is susceptible to blind server-side request forgery. An attacker with network access via HTTP can gain read access to a subset of data, connect to internal services like HTTP-enabled databases, or perform post requests towards internal services which are not intended to be exposed. Affected supported versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html↗web.archive.orghttp://web.archive.org/web/20211206102649/https://securitytracker.com/id/1041897↗medium.comhttps://medium.com/@x41x41x41/unauthenticated-ssrf-in-oracle-ebs-765bd789a145↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2018-3167↗www.securitytracker.comhttp://www.securitytracker.com/id/1041897↗