PT-2018-13797 · Microsoft+1 · Asp.Net+2

Ben N · Published 2018-09-18 · Updated 2019-10-03 · CVE-2018-16958

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Interaction Portal version 10.3.3

Description A security issue exists where the ASP.NET SessionID primary session cookie is not protected with the HttpOnly attribute when Internet Information Services (IIS) with ASP.NET is used. This exposes the cookie to session hijacking attacks if an adversary can execute JavaScript in the origin of the portal installation.

Recommendations For Oracle WebCenter Interaction Portal version 10.3.3, consider restricting access to sensitive areas of the portal to minimize the risk of session hijacking until a more permanent solution can be found. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-16958

Affected Products

Asp.Net

Internet Information Services

Oracle Webcenter Interaction Portal

References · 4

• https://osv.dev/vulnerability/CVE-2018-16958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16958 · Security Note
• http://securityfocus.com/bid/105350 · Note
• https://seclists.org/fulldisclosure/2018/Sep/22 · Note