PT-2018-13798 · Microsoft+1 · Active Directory+1

Ben N · Published 2018-09-18 · Updated 2018-12-06 · CVE-2018-16959

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Interaction Portal version 10.3.3

Description An issue was discovered in the portal component of Oracle WebCenter Interaction Portal, which is delivered with an insecure default User Profile community configuration. This configuration allows anonymous users to retrieve the account names of all portal users via the "/portal/server.pt/user/user/" endpoint. When synchronized with Active Directory (AD), this issue can expose the account names of all AD users.

Recommendations For Oracle WebCenter Interaction Portal version 10.3.3, consider restricting access to the "/portal/server.pt/user/user/" endpoint to prevent anonymous users from retrieving account names. Additionally, review and modify the default User Profile community configuration to enhance security. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-16959

Affected Products

Active Directory

Oracle Webcenter Interaction Portal

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-16959 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16959 · Vendor Advisory
• http://securityfocus.com/bid/105350 · Note
• https://seclists.org/fulldisclosure/2018/Sep/22 · Note