Multiple vulnerabilities in Oracle WebCenter Sites



Published: 2021-10-19
Risk High
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2019-12415
CVE-2021-27906
CVE-2021-26272
CVE-2020-5258
CVE-2021-29505
CVE-2019-13990
CWE-ID CWE-611
CWE-400
CWE-20
CWE-502
Exploitation vector Network
Public exploit Public exploit code for vulnerability #5 is available.
Vulnerable software
Subscribe 		Oracle WebCenter Sites
Web applications / Other software

Vendor Oracle

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) XML External Entity injection

EUVDB-ID: #VU22545

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-12415

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents. A remote attacker can pass a specially crafted XML code to the affected application and read files from the local filesystem or from internal network resources on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle WebCenter Sites: 12.2.1.3.0 - 12.2.1.4.0

Fixed software versions

CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2021.html?3221


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Resource exhaustion

EUVDB-ID: #VU51605

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-27906

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing PDF files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle WebCenter Sites: 12.2.1.3.0 - 12.2.1.4.0

Fixed software versions

CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2021.html?3221


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Input validation error

EUVDB-ID: #VU50054

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-26272

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to perform a regular expression denial of service (ReDoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to paste a specially crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin) and perform a regular expression denial of service (ReDoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle WebCenter Sites: 12.2.1.3.0 - 12.2.1.4.0

Fixed software versions

CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2021.html?3221


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Improper input validation

EUVDB-ID: #VU30113

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-5258

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Cluster: Packaging (dojo) component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle WebCenter Sites: 12.2.1.3.0 - 12.2.1.4.0

Fixed software versions

CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2021.html?3221


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Deserialization of Untrusted Data

EUVDB-ID: #VU54675

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-29505

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote user can pass specially crafted XML data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle WebCenter Sites: 12.2.1.3.0 - 12.2.1.4.0

Fixed software versions

CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2021.html?3221


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) XML External Entity injection

EUVDB-ID: #VU19595

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-13990

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to conduct an XML External Entity (XXE) attack on a targeted system.

The vulnerability exists due to insufficient validation of user-supplied XML input in the "initDocumentParser" function in the "xml/XMLSchedulingDataProcessor.java" file. A remote authenticated attacker can submit a malicious job description to the targeted system and conduct an XXE attack.


Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle WebCenter Sites: 12.2.1.3.0 - 12.2.1.4.0

Fixed software versions

CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2021.html?3221


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###