PT-2019-3680 · Oracle · Oracle Outside In Technology

Published 2019-10-15 · Updated 2019-10-21 · CVE-2019-2971

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Outside In Technology version 8.5.4

Description The issue is related to inadequate access control in the Outside In Filters component of Oracle Outside In Technology, a software development kit (SDK). Exploitation of this issue can allow a remote attacker to compromise the integrity of data, gain access to confidential data, and cause a partial denial of service using the HTTP protocol. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data.

Recommendations For version 8.5.4, update to a version that includes a fix for this issue to prevent unauthorized access and data compromise. As a temporary workaround, consider restricting access to the Outside In Filters component to minimize the risk of exploitation. Additionally, ensure that any software using the Outside In Technology code does not pass unvalidated data received over a network directly to the Outside In Technology code.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-03903

CVE-2019-2971

Affected Products

Oracle Outside In Technology

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-2971 · Security Note
• https://osv.dev/vulnerability/CVE-2019-2971 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03903 · Security Note
• https://oracle.com/security-alerts/cpuoct2019verbose.html#FMW · Note
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Note