SB2019061830 - Multiple vulnerabilities in Fuse 7.3

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019061830

SB2019061830 - Multiple vulnerabilities in Fuse 7.3

Published: June 18, 2019 Updated: April 24, 2025

Security Bulletin ID SB2019061830
Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 60% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2016-2510)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Jave APIs (BeanShell) component in Oracle Data Integrator. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


2) Deserialization of untrusted data (CVE-ID: CVE-2017-5645)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists receiving serialized log events from another application when using the TCP socket server or UDP socket server. A remote attacker can submit a specially crafted binary payload, when deserialized, and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

3) XXE attack (CVE-ID: CVE-2017-15691)

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper restriction of XML External Entity (XXE) references. A remote attacker can trick the victim into opening a specially crafted XML document that submits malicious XML entities that are parsed by the XML parser, gain access to potentially sensitive information, such as local files or other internal information.

4) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2018-3258)

The vulnerability allows an attacker to operate the product.

The vulnerability exists due to the access control bypass in the in the "Connector/J" component. A remote authenticated attacker with network access via multiple protocols can takeover the MySQL Connectors.

5) Information disclosure (CVE-ID: CVE-2018-11798)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to unspecified flaw. A remote attacker can access files outside the set webservers docroot path.


Remediation

Install update from vendor's website.

References