PT-2014-4702 · Oracle · Oracle Fusion Middleware+1

Published 2014-04-16 · Updated 2014-06-21 · CVE-2014-2452

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware version 11.1.1.5

Description The issue affects the availability of the system, allowing remote authenticated users to impact it via unknown vectors related to the Webserver Plugin in the Oracle Access Manager component.

Recommendations For Oracle Fusion Middleware version 11.1.1.5, consider restricting access to the Webserver Plugin in the Oracle Access Manager component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2014-2452

Affected Products

Oracle Access Manager

Oracle Fusion Middleware

References · 5

• http://oracle.com/technetwork/topics/security/cpuapr2014-1972952.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2452 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2452 · Note
• http://packetstormsecurity.com/files/127047/Oracle-Access-Manager-Information-Disclosure.html · Note
• http://securityfocus.com/bid/66865 · Note