PT-2018-13795 · Oracle · Oracle Webcenter Interaction Portal

Ben N · Published 2018-09-18 · Updated 2018-12-06 · CVE-2018-16956

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Interaction Portal version 10.3.3

Description The issue concerns the AjaxControl component, which fails to validate page names during rename requests. This allows pages to be renamed with characters unsupported by the web server, such as 0x7f, leading to a Denial of Service (DoS) as these pages become inaccessible over the web server.

Recommendations For Oracle WebCenter Interaction Portal version 10.3.3, consider restricting the ability to rename pages to authorized personnel and implement validation to prevent the use of unsupported characters in page names. As a temporary workaround, monitor page rename requests to prevent the inclusion of unsupported characters. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-16956

Affected Products

Oracle Webcenter Interaction Portal

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-16956 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16956 · Vendor Advisory
• https://seclists.org/fulldisclosure/2018/Sep/22 · Note
• http://securityfocus.com/bid/105350 · Note