Oracle Enterprise Manager Grid Control CVE-2012-3219 Open Redirection Vulnerability

Bugtraq ID:	57349
Class:	Input Validation Error
CVE:	CVE-2012-3219
Remote:	Yes
Local:	No
Published:	Jan 15 2013 12:00AM
Updated:	Feb 27 2014 12:41PM
Credit:	Qinglin Jiang of Application Security Inc.
Vulnerable:
Not Vulnerable:

Oracle Enterprise Manager Grid Control CVE-2012-3219 Open Redirection Vulnerability

Oracle Enterprise Manager Grid Control is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

This vulnerability affects the following supported versions:
EM Base Platform: 10.2.0.5, 11.1.0.1; EM DB Control: 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3; EM Plugin for DB: 12.1.0.1, 12.1.0.2

Oracle Enterprise Manager Grid Control CVE-2012-3219 Open Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to following a malicious URI.

Oracle Enterprise Manager Grid Control CVE-2012-3219 Open Redirection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oracle Enterprise Manager Grid Control CVE-2012-3219 Open Redirection Vulnerability

References:

• Oracle Homepage (Oracle)