CVE-2026-35253

Vulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported versions that is affected is v0.22.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Macaron Tool. Successful attacks of this vulnerability can result in Oracle Macaron Tool failing host address validation.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:macaron:0.22.0:*:*:*:*:*:*:*

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto Oracle Macaron Tool de Oracle Open Source Projects. Las versiones soportadas que están afectadas son v0.22.0. Vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red a través de HTTP comprometer Oracle Macaron Tool. Ataques exitosos de esta vulnerabilidad pueden resultar en que Oracle Macaron Tool falle la validación de la dirección del host.

Information

Published : 2026-05-06 08:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-35253

Mitre link : CVE-2026-35253

CVE.ORG link : CVE-2026-35253

JSON object : View

Products Affected

oracle

macaron

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

CWE-346

Origin Validation Error

{"id": "CVE-2026-35253", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35253", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T18:42:05.583467Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Macaron Tool of Oracle Open Source Projects", "versions": [{"status": "affected", "version": "v0.22.0"}]}]}], "published": "2026-05-06T08:16:03.570", "references": [{"url": "https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html", "tags": ["Not Applicable"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-601"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported versions that is affected is v0.22.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Macaron Tool. Successful attacks of this vulnerability can result in Oracle Macaron Tool failing host address validation."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Macaron Tool de Oracle Open Source Projects. Las versiones soportadas que est\u00e1n afectadas son v0.22.0. Vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado con acceso a la red a trav\u00e9s de HTTP comprometer Oracle Macaron Tool. Ataques exitosos de esta vulnerabilidad pueden resultar en que Oracle Macaron Tool falle la validaci\u00f3n de la direcci\u00f3n del host."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:macaron:0.22.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4FA7633-EEE0-45F0-A83B-473403DF964E"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}