CVE-2008-5446 json
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote au…
published 2009-01-14 17 y ago modified 2026-06-16 4 mo ago also EUVD-2008-5423
- cvss
- 3.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is related to unrestricted guest access to the "About Us Page" in the Oracle Applications Framework (OAF), which allows attackers to obtain sensitive system and application environment information.
Exploit prediction
1.34% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- securityfocus.com http://www.securityfocus.com/bid/33177 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:P/I:N/A:N |
References
-
securityfocus.com
/bid/33177
vdb-entry, exploit
-
secunia.com
/advisories/33525
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2009/0115
vdb-entry, vendor-advisory
-
securityfocus.com
/archive/1/500171/100/0/threaded
mailing-list
- secniche.org /papers/orabs.pdf
- oracle.com /technetwork/topics/security/cpujan2009-097901.html
-
securitytracker.com
/id?1021568
vdb-entry
Sources
- CVE List CVE-2008-5446
- NVD CVE-2008-5446
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.