CVE-2016-3438
HighSummary
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to JRAD Heartbeat.
Risk Assessment
This vulnerability may lead to breaches of data confidentiality and integrity within the system, posing a serious threat to the organization.
Recommendation
It is recommended to update to the latest version of Oracle software and monitor the system for suspicious activity.
Other vulnerabilities in Oracle Configurator
See all- CVE-2025-61884HighActively exploited
Vulnerability in Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI) affects versions 12.2.3-12.2.14. It is easily exploitable by an unauthenticated attacker with network access via HTTP, potentially resulting in unauthorized access to critical data or complete access to all Oracle Configurator data. CVSS 3.1 Base Score is 7.5 (Confidentiality impact).
- CVE-2026-34274Medium
Vulnerability in Oracle Configurator (component: User Interface) affecting versions 12.2.3-12.2.15. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the product with human interaction, resulting in unauthorized update, insert or delete access and unauthorized read access to a subset of data, with potential impact on additional products (scope change).
Original NVD description (English source)
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to JRAD Heartbeat. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that that this issue involves multiple cross-site scripting (XSS) vulnerabilities, which allow remote attackers to inject arbitrary web script or HTML via three unspecified parameters in an unknown JSP file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS