The Feature

Do Not Forward Oracle Notifications from Outlook!

February 9, 2006 on 9:44 pm | by Marian Crkon | In Feature of the Week | Enter Comments |  Print |  Email

You can encounter this feature if you are using Oracle Internet Expenses and use email notifications to approve expense reports:

The Feature

There is a vulnerability in iExpenses approval workflow. Here is a scenario:

• Employee enters his expenses report and submits to his manager
• Manager receives an email notification to approve the expense report
• Manager forwards the notification USING OUTLOOK FORWARD FUNCTION (not an Oracle link provided in the email) to the the expense report preparer requesting more information.
• Employee receives the manager’s approval email, and is able to approve his own expense report.
• Expense report in iExpenses becomes approved, and shows it was approved by the expected approver.

The Summary

Employee can approve his own expense report after his manager forwarded the approval email to him. Furthermore, in Oracle iExpenses it looks like the expense report was approved by the manager himself.

The Workaround

Configure the Workflow Mailer to not allow a user to respond by email to an email notification that has been forwarded from another user. As Oracle Applications Manager (available from the Oracle Applications Rapid Install Portal window):

• Log in as Oracle Application Manager
• Navigate to Workflow Manager page
• Under Workflow System: click on Notification Mailers
• Click on your Mailer Name, and then Edit.
• Navigate to Edit Workflow Mailer: EMail Servers page.
• Make sure to uncheck the Allow Forwarded Response flag.