Oracle E-Business Suite 'OA.jsp' Oracle iRecruitment URL Redirection Vulnerability

Bugtraq ID:	43952
Class:	Unknown
CVE:	CVE-2010-2408
Remote:	Yes
Local:	No
Published:	Oct 12 2010 12:00AM
Updated:	Nov 25 2010 06:56PM
Credit:	Aditya K Sood of SecNiche Security
Vulnerable:	Oracle E-Business Suite 12 12.0.6 Oracle E-Business Suite 12 12.1.3 Oracle E-Business Suite 11i 11.5.10.2
Not Vulnerable:

Oracle E-Business Suite 'OA.jsp' Oracle iRecruitment URL Redirection Vulnerability

Oracle E-Business Suite is prone to a remote URL-redirection vulnerability in Oracle iRecruitment.

An attacker can leverage this issue by constructing a URI that includes a malicious site redirection. When an unsuspecting victim follows the URI, they may be redirected to an attacker-controlled site; this may aid in phishing attacks.

This vulnerability affects the following supported versions:
11.5.10.2, 12.0.6, 12.1.3

Oracle E-Business Suite 'OA.jsp' Oracle iRecruitment URL Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Oracle E-Business Suite 'OA.jsp' Oracle iRecruitment URL Redirection Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for more information.

Oracle E-Business Suite 'OA.jsp' Oracle iRecruitment URL Redirection Vulnerability

References:

• CVE-2010-2408 | Persistent Log Out Redirection Vulnerability in Oracle I-Recrui ([email protected])
  
• Oracle Critical Patch Update Advisory - October 2010 (Oracle)