SB2019011580 - Multiple vulnerabilities in Oracle WebLogic Server
Published: January 15, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2019-2398)
The vulnerability allows a remote authenticated user to manipulate data.
The vulnerability exists due to improper input validation within the WLS - Deployment component in Oracle WebLogic Server. A remote authenticated user can exploit this vulnerability to manipulate data.
2) Improper input validation (CVE-ID: CVE-2019-2441)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Application Container - JavaEE component in Oracle WebLogic Server. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
3) Improper input validation (CVE-ID: CVE-2019-2395)
The vulnerability allows a remote authenticated user to read memory contents or crash the application.
The vulnerability exists due to improper input validation within the WLS - Web Services component in Oracle WebLogic Server. A remote authenticated user can exploit this vulnerability to read memory contents or crash the application.
4) Cross-site scripting (CVE-ID: CVE-2015-9251)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when a cross-domain Ajax request is performed without the dataType option. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary text/javascript responses in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
5) Improper input validation (CVE-ID: CVE-2019-2418)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the WLS Core Components component in Oracle WebLogic Server. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
6) Improper input validation (CVE-ID: CVE-2019-2452)
The vulnerability allows a remote privileged user to execute arbitrary code.
The vulnerability exists due to improper input validation within the WLS Core Components component in Oracle WebLogic Server. A remote privileged user can exploit this vulnerability to execute arbitrary code.
7) Improper input validation (CVE-ID: CVE-2018-1000180)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the IDIH Visualization (Bouncy Castle Java Library) component in Oracle Communications Diameter Signaling Router (DSR). A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
8) XXE attack (CVE-ID: CVE-2015-1832)
The vulnerability allows a remote user to conduct XXE attack.The weakness exists due to XML external entity error. Via vectors involving XmlVTI and the XML datatype context-dependent attackers can view arbitrary files that may lead to denial of service.
Successful exploitation of the vulnerability can result in potentially sensitive information disclosure and denial of service on the vulnerable system.
Remediation
Install update from vendor's website.