SB2018011809 - Multiple vulnerabilities in Oracle Fusion Middleware

Description

This security bulletin contains information about 8 vulnerabilities.

1) Security restrictions bypass (CVE-ID: CVE-2017-10068)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Oracle Business Intelligence Enterprise Edition Analytics Web Dashboards component. A remote attacker can access and partially modify data.

2) Security restrictions bypass (CVE-ID: CVE-2017-10273)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear

The vulnerability allows a local attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Oracle JDeveloper Deployment component. A local attacker can partially access data, partially modify data, and partially deny service.

3) Security restrictions bypass (CVE-ID: CVE-2018-2564)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Oracle WebCenter Content Content Server component. A remote attacker can partially access and modify data.

4) Information disclosure (CVE-ID: CVE-2018-2584)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to a flaw in the Oracle WebCenter Sites Advanced UI component. A remote attacker can partially access data.

5) Security restrictions bypass (CVE-ID: CVE-2018-2596)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Oracle WebCenter Content Content Server component. A remote attacker can partially access and modify data.

6) Security restrictions bypass (CVE-ID: CVE-2018-2711)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Oracle JDeveloper Security Framework component. A remote attacker can access and partially modify data.

7) Security restrictions bypass (CVE-ID: CVE-2018-2713)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the Oracle WebCenter Portal WebCenter Spaces Application component. A remote attacker can partially access and modify data.

8) Information disclosure (CVE-ID: CVE-2018-2715)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to a flaw in the Oracle Business Intelligence Enterprise Edition BI Platform Security component. A remote attacker can access important data.

Remediation

Install update from vendor's website.

References

• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html