PT-2019-3753 · Oracle · Adf+2

Khaled Sakr · Published 2019-10-15 · Updated 2023-01-31 · CVE-2019-2899

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle JDeveloper and ADF versions 11.1.1.9.0 through 12.2.1.3.0

Description The issue is related to insufficient access control in the OAM component of Oracle JDeveloper and ADF, allowing a remote attacker to gain unauthorized access to protected information via the HTTP protocol. The attack requires human interaction from someone other than the attacker and can result in unauthorized read access to a subset of accessible data.

Recommendations For versions 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0, and 12.2.1.3.0, consider restricting access to the OAM component until a patch is available. As a temporary workaround, consider disabling the vulnerable OAM component to minimize the risk of exploitation. Restrict network access via HTTP to the Oracle JDeveloper and ADF product to reduce the attack surface.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-04011

CVE-2019-2899

Affected Products

Adf

Oam

Oracle Jdeveloper

References · 6

• https://osv.dev/vulnerability/CVE-2019-2899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-2899 · Security Note
• https://oracle.com/security-alerts/cpuapr2020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04011 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Note