Medium severity · published Jul 21, 2016
CVE-2016-3448
Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.4 allows remote attackers to affect confidentiality and integrity via unknown…
6.1
CVSS
1.7%
EPSS
No
On KEV
Description
Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.4 allows remote attackers to affect confidentiality and integrity via unknown vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Application Express · Oracle
through 5.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-3448
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-3448
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Third Party Advisory
http://www.securityfocus.com/bid/91787
www.securityfocus.com
http://www.securityfocus.com/bid/91885
www.securitytracker.com
http://www.securitytracker.com/id/1036363
More from Application Express
6.1
CVE-2020-11023
Potential XSS vulnerability in jQuery
9.0
CVE-2025-50067
Vulnerability in Oracle Application Express (component: Strategic Planner Starter App)
9.0
CVE-2023-21975
Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account)
9.0
CVE-2023-21974
Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account)
7.5
CVE-2022-24729
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor