PT-2023-1241 · Oracle · Oracle Web Services Manager

Published 2023-01-17 · Updated 2024-09-17 · CVE-2023-21862

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle Web Services Manager version 12.2.1.4.0

Description The issue is related to insufficient input validation in the XML Security component of Oracle Web Services Manager, part of Oracle Fusion Middleware. This easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager, but successful attacks require human interaction from a person other than the attacker. The exploitation can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Web Services Manager accessible data, as well as unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data.

Recommendations For version 12.2.1.4.0, update to a version that includes the fix for this issue to prevent unauthorized access and data modification. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

RCE

Weakness Enumeration

CWE-611

CWE-20

Related Identifiers

BDU:2023-00502

CVE-2023-21862

Affected Products

Oracle Web Services Manager

References · 4

• https://oracle.com/security-alerts/cpujan2023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21862 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00502 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-21862 · Security Note