PT-2019-3680 · Oracle · Oracle Outside In Technology
Publicado
2019-10-15
·
Atualizado
2019-10-21
·
CVE-2019-2971
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Oracle Outside In Technology version 8.5.4
Description
The issue is related to inadequate access control in the Outside In Filters component of Oracle Outside In Technology, a software development kit (SDK). Exploitation of this issue can allow a remote attacker to compromise the integrity of data, gain access to confidential data, and cause a partial denial of service using the HTTP protocol. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data.
Recommendations
For version 8.5.4, update to a version that includes a fix for this issue to prevent unauthorized access and data compromise. As a temporary workaround, consider restricting access to the Outside In Filters component to minimize the risk of exploitation. Additionally, ensure that any software using the Outside In Technology code does not pass unvalidated data received over a network directly to the Outside In Technology code.
Correção
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Oracle Outside In Technology