Vulnerability disclosure
Cross-site scripting vulnerability in Oracle Enterprise Command Center
Oracle E-Business Suite – ECC Framework
CVE-2023-22107 is a cross-site scripting flaw in the Oracle Enterprise Command Center (ECC) Framework component of Oracle E-Business Suite. An unauthenticated, network-based attacker who tricks a legitimate user into interacting with a crafted request can execute script in that user's session, gaining unauthorised read and update access to a subset of ECC data and connected products. Oracle fixed it in the October 2023 Critical Patch Update.
OffSeq
3 min read
Severity: MediumCVSS 6.1CVE-2023-22107
Key facts
- Identifier
- CVE-2023-22107
- Class
- Cross-site scripting (CWE-79)
- Severity
- Medium
- CVSS
- 6.1
- Product
- Oracle E-Business Suite – ECC Framework
- Affected
- Versions 8, 9, 10
- Fixed in
- Oracle CPU October 2023
- Role
- Reported by OffSeq founder
CVSS base score
/ 10Medium
Every score is built from eight plain questions about how an attack works and what it costs you.
How hard it is to exploit
What the attacker can do
Select a metric to see what it means
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
§ 01. Overview
CVE-2023-22107 is a cross-site scripting (XSS) vulnerability in the Enterprise Command Center (ECC) Framework, a component of Oracle E-Business Suite. The ECC Framework provides interactive dashboards and guided data-discovery interfaces that let users navigate transactional information across E-Business Suite modules through visual, faceted components.
Oracle assigned the issue a CVSS 3.1 base score of 6.1 (Medium) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. It affects ECC Framework versions 8, 9, and 10. The vulnerability was disclosed in Oracle's October 2023 Critical Patch Update and is credited to the OffSeq founder as the discoverer.
§ 02. How it works
The root cause is a cross-site scripting weakness (CWE-79): attacker-influenced input is reflected or stored by the ECC Framework and rendered in a user's browser without adequate output encoding or contextual sanitization. As a result, an attacker can supply markup or script that the application emits into an HTML response, where the victim's browser executes it in the trust context of the ECC application origin.
The CVSS vector captures the mechanics precisely. AV:N with PR:N means the attack is delivered over the network by an unauthenticated actor. UI:R indicates that exploitation requires a human other than the attacker to interact – for example, a logged-in ECC user following a crafted link or loading a page containing the injected payload. S:C (scope changed) reflects that code executing in the victim's authenticated session can reach beyond the ECC Framework itself into connected products, which is characteristic of an XSS bug where the vulnerable component and the impacted resources differ. C:L/I:L/A:N indicates limited confidentiality and integrity impact and no direct impact on availability.
§ 03. Impact
Because exploitation runs in the context of the targeted user's authenticated session, a successful attack can result in unauthorised read access and unauthorised update (insert, delete, and modify) access to a subset of data accessible through the ECC Framework. The scope-change property means the consequences are not confined to ECC: the injected script can also affect data belonging to products connected to the framework.
The practical risk profile is that of a session-scoped web attack against E-Business Suite operators. An attacker cannot act directly with the privileges of the application, but by hijacking the interaction of a legitimate user they can perform actions and read data that user is authorised for. The requirement for victim interaction and the limited impact ratings are why the issue is rated Medium rather than High, but ECC deployments typically front sensitive enterprise transactional data, so the exposure is meaningful in real environments.
§ 04. Affected and fixed versions
The vulnerability affects Oracle Enterprise Command Center Framework versions 8, 9, and 10. Oracle addressed it in the Critical Patch Update released in October 2023.
Administrators should apply the relevant October 2023 CPU patches for their ECC Framework version. As with all Oracle CPU items, the fix is only available through the quarterly patch bundle, and Oracle recommends staying current with Critical Patch Updates rather than applying isolated fixes.
§ 05. Disclosure timeline
- 2023-10-17Disclosed in Oracle's October 2023 Critical Patch Update and published to the NVD
References
- NVD – CVE-2023-22107 (opens in a new tab) (https://nvd.nist.gov/vuln/detail/CVE-2023-22107)
- Oracle Critical Patch Update Advisory – October 2023 (opens in a new tab) (https://www.oracle.com/security-alerts/cpuoct2023.html)
- CVE.org record – CVE-2023-22107 (opens in a new tab) (https://www.cve.org/CVERecord?id=CVE-2023-22107)
Credit
Discovered and reported by Nils Putniņš (OffSeq Cybersecurity); credited in Oracle's October 2023 Critical Patch Update.
More results
SQL injection affecting customer data, responsibly disclosed
OffSeq founder Nils Putniņš identified a SQL injection vulnerability on the website of an international company that could have exposed customer data, and reported it through CERT.LV, Latvia's national CERT. The issue was handled under responsible-disclosure principles and remediated promptly.
Coordinated vulnerability disclosure20233 min read
SWQL injection in SolarWinds Platform
CVE-2024-28996 is a SWQL (SolarWinds Query Language) injection flaw in the SolarWinds Platform that let a crafted query manipulate the underlying database layer. It was found during penetration testing for the NATO Communications and Information Agency and fixed in SolarWinds Platform 2024.2.
Vulnerability disclosure20243 min read
Server crash in CERT.LV’s Graphoscope when a user disconnects during an upload
OffSeq found a denial-of-service flaw in Graphoscope, the open-source platform CERT.LV publishes for querying many independent data sources from one interface and showing their relations as a graph. A user who uploaded an indicator list and closed the connection before processing finished made the server dereference a nil WebSocket and crash, signing out every user. Any self-registered account could trigger it reliably. OffSeq reported the issue to CERT.LV and contributed the fix, which CERT.LV merged.
Vulnerability disclosure20263 min read