Vulnerability Name:

CVE-2007-2135 (CCN-33809)

Assigned:2007-04-17
Published:2007-04-17
Updated:2018-10-16
Summary:The ADI_BINARY component in the Oracle E-Business Suite allows remote attackers to download arbitrary documents from the APPS.FND_DOCUMENTS table via the ADI_DISPLAY_REPORT function, when passed a certain parameter.
Note: due to lack of details from Oracle, it is not clear whether this issue is related to other CVE identifiers such as CVE-2007-2126, CVE-2007-2127, or CVE-2007-2128.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N)
5.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): 
Access Complexity (AC): 
Authentication (Au): 
Impact Metrics:Confidentiality (C): 
Integrity (I): 
Availibility (A): 
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): 
Access Complexity (AC): 
Athentication (Au): 
Impact Metrics:Confidentiality (C): 
Integrity (I): 
Availibility (A): 
Vulnerability Type:CWE-Other
Vulnerability Consequences:Obtain Information
References:Source: CCN
Type: Full-Disclosure Mailing List, Wed Apr 18 2007 - 11:07:27 CDT
Oracle E-Business Suite Vulnerability Information April 2007

Source: MITRE
Type: CNA
CVE-2007-2108

Source: MITRE
Type: CNA
CVE-2007-2109

Source: MITRE
Type: CNA
CVE-2007-2110

Source: MITRE
Type: CNA
CVE-2007-2111

Source: MITRE
Type: CNA
CVE-2007-2112

Source: MITRE
Type: CNA
CVE-2007-2113

Source: MITRE
Type: CNA
CVE-2007-2114

Source: MITRE
Type: CNA
CVE-2007-2115

Source: MITRE
Type: CNA
CVE-2007-2116

Source: MITRE
Type: CNA
CVE-2007-2117

Source: MITRE
Type: CNA
CVE-2007-2118

Source: MITRE
Type: CNA
CVE-2007-2119

Source: MITRE
Type: CNA
CVE-2007-2120

Source: MITRE
Type: CNA
CVE-2007-2121

Source: MITRE
Type: CNA
CVE-2007-2122

Source: MITRE
Type: CNA
CVE-2007-2123

Source: MITRE
Type: CNA
CVE-2007-2124

Source: MITRE
Type: CNA
CVE-2007-2125

Source: MITRE
Type: CNA
CVE-2007-2126

Source: MITRE
Type: CNA
CVE-2007-2127

Source: MITRE
Type: CNA
CVE-2007-2128

Source: MITRE
Type: CNA
CVE-2007-2129

Source: MITRE
Type: CNA
CVE-2007-2130

Source: MITRE
Type: CNA
CVE-2007-2131

Source: MITRE
Type: CNA
CVE-2007-2132

Source: MITRE
Type: CNA
CVE-2007-2133

Source: MITRE
Type: CNA
CVE-2007-2134

Source: MITRE
Type: CNA
CVE-2007-2135

Source: MITRE
Type: CNA
CVE-2007-2170

Source: OSVDB
Type: UNKNOWN
39959

Source: SREASON
Type: UNKNOWN
2612

Source: CCN
Type: IBM Security Bulletin 1268889
Oracle Engine Upgrade and Critical Patch - TCIM 6.0/7.0/8.0 Embedded Database Engine Upgrade (10.1.0.5) and April 2007 Oracle Critical Path Update

Source: CCN
Type: US-CERT VU#809457
Oracle Database vulnerable to privilege escalation

Source: CCN
Type: Oracle Critical Patch Update - April 2007
Oracle Critical Patch Update Advisory - April 2007

Source: MISC
Type: Patch
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2007.html

Source: CCN
Type: OSVDB ID: 39920
Oracle PeopleSoft Enterprise Human Capital Management Unspecified Information Disclosure

Source: CCN
Type: OSVDB ID: 39921
Oracle PeopleSoft JD Edwards HTTP Server Browser Cache Login Credential Disclosure

Source: CCN
Type: OSVDB ID: 39922
Oracle PeopleSoft PeopleTools Unspecified FTP Script Upload Issue

Source: CCN
Type: OSVDB ID: 39923
Oracle PeopleSoft PeopleTools Unspecified Stored XSS

Source: CCN
Type: OSVDB ID: 39924
Oracle Database Core RDBMS NTLM SSPI AcceptSecurityContext Function Remote Privilege Escalation

Source: CCN
Type: OSVDB ID: 39925
Oracle Database Rules Manager Expression Filter RLMGR_TRUNCATE_MAINT Trigger Race Condition

Source: CCN
Type: OSVDB ID: 39926
Oracle Database Core RDBMS NULL DACL Multiple Function Arbitrary Code Execution

Source: CCN
Type: OSVDB ID: 39929
Oracle Database Streams DBMS_APPLY_USER_AGENT.SET_REGISTRATION_HANDLER Procedure SQL Injection

Source: CCN
Type: OSVDB ID: 39931
Oracle Database Change Data Capture (CDC) DBMS_CDC_IPUBLISH.CHGTAB_CACHE CHANGE_TABLE_NAME Parameter Remote Overflow

Source: CCN
Type: OSVDB ID: 39932
Oracle Database Change Data Capture (CDC) DBMS_CDC_PUBLISH Multiple SQL Injections

Source: CCN
Type: OSVDB ID: 39934
Oracle Database Instant Client genezi Command Unspecified Local Issue

Source: CCN
Type: OSVDB ID: 39935
Oracle Database Text ctxsrv Command Unspecified Local Issue

Source: CCN
Type: OSVDB ID: 39936
Oracle Database Upgrade/Downgrade mig Command Local Overflow

Source: CCN
Type: OSVDB ID: 39939
Oracle Database Agent Unauthenticated Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39940
Oracle Collaboration Suite Workspace Unspecified Authenticated Issue (OCS01)

Source: CCN
Type: OSVDB ID: 39942
Oracle Application Server COREid Access HTTP Unspecified Remote Issue

Source: CCN
Type: OSVDB ID: 39943
Oracle Application Server Wireless HTTP Unspecified Remote Issue

Source: CCN
Type: OSVDB ID: 39944
Oracle Application Server Portal HTTP Unspecified Remote Issue

Source: CCN
Type: OSVDB ID: 39945
Oracle Application Server Portal HTTP Unspecified Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39948
Oracle E-Business Suite Report Manager Unauthenticated Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39949
Oracle E-Business Suite Application Object Library Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39950
Oracle E-Business Suite iStore Unspecified Remote Information Disclosure (APPS05)

Source: CCN
Type: OSVDB ID: 39951
Oracle E-Business Suite iStore Unspecified Remote Information Disclosure (APPS06)

Source: CCN
Type: OSVDB ID: 39952
Oracle E-Business Suite iSupport Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39953
Oracle E-Business Suite Sales Online Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39954
Oracle E-Business Suite Trade Management Remote Information Disclosure

Source: CCN
Type: OSVDB ID: 39955
Oracle E-Business Suite Applications Manager Patch Administrator Local Information Disclosure

Source: CCN
Type: Red-Database-Security Web site
Details Oracle Critical Patch Update April 2007

Source: MISC
Type: Patch
http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html

Source: BUGTRAQ
Type: UNKNOWN
20070418 ZDI-07-017: Oracle E-Business Suite Arbitrary Document Download Vulnerability

Source: MISC
Type: Patch
http://www.zerodayinitiative.com/advisories/ZDI-07-017.html

Source: XF
Type: UNKNOWN
oracle-cpu-april2007(33809)

Source: CCN
Type: IBM Internet Security Systems X-Force Database
Oracle E-Business Suite APPLSYS.FND_DM_NODES node deletion

Vulnerable Configuration:Configuration 1:
  • cpe:/a:oracle:e-business_suite:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Vulnerability Name:

    CVE-2007-2135 (CCN-33835)

    Assigned:2007-04-17
    Published:2007-04-17
    Updated:2007-04-17
    Summary:Oracle E-Business Suite could allow a remote attacker to obtain sensitive information, caused by a vulnerability in the ADI_BINARY component. An attacker could exploit this vulnerability to view arbitrary documents in the APPS.FND_DOCUMENTS table.
    CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
    Exploitability Metrics:Attack Vector (AV): Network
    Attack Complexity (AC): Low
    Privileges Required (PR): None
    User Interaction (UI): None
    Scope:Scope (S): Unchanged
    Impact Metrics:Confidentiality (C): Low
    Integrity (I): None
    Availibility (A): None
    CVSS v2 Severity:7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N)
    5.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C)
    Exploitability Metrics:Access Vector (AV): 
    Access Complexity (AC): 
    Authentication (Au): 
    Impact Metrics:Confidentiality (C): 
    Integrity (I): 
    Availibility (A): 
    5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
    3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
    Exploitability Metrics:Access Vector (AV): 
    Access Complexity (AC): 
    Athentication (Au): 
    Impact Metrics:Confidentiality (C): 
    Integrity (I): 
    Availibility (A): 
    Vulnerability Consequences:Obtain Information
    References:Source: CCN
    Type: Full-Disclosure Mailing List, Wed Apr 18 2007 - 11:07:27 CDT
    Oracle E-Business Suite Vulnerability Information April 2007

    Source: MITRE
    Type: CNA
    CVE-2007-2135

    Source: CCN
    Type: SA24929
    Oracle Products Multiple Vulnerabilities

    Source: CCN
    Type: Oracle Critical Patch Update - April 2007
    Oracle Critical Patch Update Advisory - April 2007

    Source: CCN
    Type: OSVDB ID: 39959
    Oracle E-Business Suite ADI_BINARY Arbitrary Document Download

    Source: CCN
    Type: Red-Database-Security Web site
    Details Oracle Critical Patch Update April 2007

    Source: XF
    Type: UNKNOWN
    oracle-adibinary-information-disclosure(33835)

    Source: CCN
    Type: ZDI-07-017
    Oracle E-Business Suite Arbitrary Document Download Vulnerability

    Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:oracle:e-business_suite:11.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:12.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:e-business_suite:11.5.9:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    oracle e-business suite *
    oracle e-business suite 11.5.10
    oracle e-business suite 12.0.0
    oracle e-business suite 11.5.8
    oracle e-business suite 11.5.9