PT-2018-13796 · Oracle · Oracle Webcenter Interaction

Ben N · Publicado 2018-09-18 · Atualizado 2018-12-06 · CVE-2018-16957

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Interaction version 10.3.3

Description The Oracle WebCenter Interaction search service queryd.exe binary contains a hardcoded password i1g2s3c4. This password is used for authentication to the search service and cannot be customized. An adversary with network access to the service could exploit this to perform search queries and extract large quantities of sensitive information.

Recommendations For Oracle WebCenter Interaction version 10.3.3, consider restricting access to the search service to minimize the risk of exploitation, as the hardcoded password cannot be changed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-16957

Produtos afetados

Oracle Webcenter Interaction

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-16957 · Nota de Segurança
• https://seclists.org/fulldisclosure/2018/Sep/22 · Nota
• http://securityfocus.com/bid/105350 · Nota
• https://osv.dev/vulnerability/CVE-2018-16957 · Aviso do Fabricante