Exposed dangerous method or function in Oracle Business Process Management Suite

1) Exposed dangerous method or function

EUVDB-ID: #VU28238

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10683

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to abuse implemented functionality.

The vulnerability exists due to dom4j allows by default external DTDs and External Entities. A remote attacker can abuse this functionality and perform XXE attack against application that uses dom4j default configuration.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle Business Process Management Suite: 12.2.1.3.0 - 12.2.1.4.0

CPE2.3

• cpe:2.3:a:oracle:oracle_business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:
• cpe:2.3:a:oracle:oracle_business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:

External links

http://www.oracle.com/security-alerts/cpujan2021.html?540359

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.