PT-2019-3745 · Oracle · Oracle Weblogic Server

Published 2019-10-15 · Updated 2019-10-18 · CVE-2019-2907

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.3.0

Description The issue is related to inadequate access control in the SOAP with Attachments API for Java component of Oracle WebLogic Server, part of the Oracle Fusion Middleware platform. This can be exploited by a remote attacker to gain unauthorized access to read, modify, add, or delete data via the HTTP protocol. Successful attacks can result in unauthorized update, insert, or delete access to some Oracle Web Services accessible data, as well as unauthorized read access to a subset of Oracle Web Services accessible data.

Recommendations For version 12.2.1.3.0, consider restricting access to the SOAP with Attachments API for Java component until a patch is available. As a temporary workaround, limit the use of HTTP protocol to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-04003

CVE-2019-2907

Affected Products

Oracle Weblogic Server

References · 5

• https://bdu.fstec.ru/vul/2019-04003 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-2907 · Security Note
• https://osv.dev/vulnerability/CVE-2019-2907 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Note