SB2021042519 - Multiple vulnerabilities in Enterprise Manager Base Platform
Published: April 25, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2021-2053)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the UI Framework component in Enterprise Manager Base Platform. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
2) Improper input validation (CVE-ID: CVE-2020-11994)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Security Subsystem (Apache Camel) component in Oracle Enterprise Repository. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
3) Integer overflow (CVE-ID: CVE-2020-10878)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A remote attacker can use a specially crafted regular expression, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Input validation error (CVE-ID: CVE-2019-17195)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to Nimbus JOSE+JWT throws various uncaught exceptions while parsing a JWT. A remote attacker can send a specially crafted JWT token and cause the application to crash or potentially bypass authentication.
Remediation
Install update from vendor's website.