PT-2018-13793 · Oracle · Oracle Webcenter Interaction Portal

Ben N · Publicado 2018-09-18 · Atualizado 2018-12-13 · CVE-2018-16954

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Interaction Portal version 10.3.3

Description The login function of the portal is vulnerable to insecure redirection, also known as an open redirect. The in hi redirect parameter is not validated by the application after a successful login.

Recommendations For Oracle WebCenter Interaction Portal version 10.3.3, as a temporary workaround, consider validating the in hi redirect parameter after a successful login to prevent insecure redirection. However, since Oracle WebCenter Interaction Portal is out of support, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2018-16954

Produtos afetados

Oracle Webcenter Interaction Portal

Referências · 4

• 🔥 https://seclists.org/fulldisclosure/2018/Sep/22 · Exploit
• https://osv.dev/vulnerability/CVE-2018-16954 · Aviso do Fabricante
• http://securityfocus.com/bid/105350 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16954 · Nota de Segurança