SB20190115115 - Improper input validation in Oracle Communications Policy Management

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20190115115

SB20190115115 - Improper input validation in Oracle Communications Policy Management

Published: January 15, 2019

Security Bulletin ID SB20190115115
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper input validation (CVE-ID: CVE-2018-11776)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient input validation in cases where namespace value isn't set for a result defined in underlying xml configurations and in same time, its upper action(s) configurations have no or wildcard namespace, or when using url tag which doesn’t have value and action set and in same time, its upper action(s) configurations have no or wildcard namespace.

A remote unauthenticated attacker can compromise the affected system.


Remediation

Install update from vendor's website.

References