PT-2018-13798 · Microsoft+1 · Active Directory+1

Ben N · Publicado 2018-09-18 · Atualizado 2018-12-06 · CVE-2018-16959

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Interaction Portal version 10.3.3

Description An issue was discovered in the portal component of Oracle WebCenter Interaction Portal, which is delivered with an insecure default User Profile community configuration. This configuration allows anonymous users to retrieve the account names of all portal users via the "/portal/server.pt/user/user/" endpoint. When synchronized with Active Directory (AD), this issue can expose the account names of all AD users.

Recommendations For Oracle WebCenter Interaction Portal version 10.3.3, consider restricting access to the "/portal/server.pt/user/user/" endpoint to prevent anonymous users from retrieving account names. Additionally, review and modify the default User Profile community configuration to enhance security. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-16959

Produtos afetados

Active Directory

Oracle Webcenter Interaction Portal

Referências · 4

• http://securityfocus.com/bid/105350 · Nota
• https://seclists.org/fulldisclosure/2018/Sep/22 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16959 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16959 · Aviso do Fabricante