PT-2018-13795 · Oracle · Oracle Webcenter Interaction Portal

Ben N · Publicado 2018-09-18 · Atualizado 2018-12-06 · CVE-2018-16956

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Interaction Portal version 10.3.3

Description The issue concerns the AjaxControl component, which fails to validate page names during rename requests. This allows pages to be renamed with characters unsupported by the web server, such as 0x7f, leading to a Denial of Service (DoS) as these pages become inaccessible over the web server.

Recommendations For Oracle WebCenter Interaction Portal version 10.3.3, consider restricting the ability to rename pages to authorized personnel and implement validation to prevent the use of unsupported characters in page names. As a temporary workaround, monitor page rename requests to prevent the inclusion of unsupported characters. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-16956

Produtos afetados

Oracle Webcenter Interaction Portal

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-16956 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16956 · Aviso do Fabricante
• https://seclists.org/fulldisclosure/2018/Sep/22 · Nota
• http://securityfocus.com/bid/105350 · Nota