PT-2017-15712 · Oracle · Oracle Fusion Middleware Mapviewer

Publicado 2017-04-19 · Atualizado 2019-10-03 · CVE-2017-3230

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:C/A:P

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware MapViewer versions 11.1.1.9, 12.2.1.1, 12.2.1.2

Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Fusion Middleware MapViewer. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data, as well as unauthorized read access to a subset of Oracle Fusion Middleware MapViewer accessible data. Additionally, it can cause a partial denial of service of Oracle Fusion Middleware MapViewer.

Recommendations For versions 11.1.1.9, 12.2.1.1, and 12.2.1.2, consider restricting access to the MapViewer component until a patch is available. As a temporary workaround, consider disabling the FileUploaderServlet to minimize the risk of exploitation. Avoid using the fileName parameter in the affected HTTP endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2017-3230

ZDI-17-288

Produtos afetados

Oracle Fusion Middleware Mapviewer

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-3230 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-17-288 · Nota de Segurança
• http://securityfocus.com/bid/97746 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3230 · Nota de Segurança
• http://securitytracker.com/id/1038291 · Nota
• http://oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html · Aviso do Fabricante