SB20240117125 - Multiple vulnerabilities in Oracle Banking Extensibility Workbench

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20240117125

SB20240117125 - Multiple vulnerabilities in Oracle Banking Extensibility Workbench

Published: January 17, 2024

Security Bulletin ID SB20240117125
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) LDAP injection (CVE-ID: CVE-2023-33201)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper input validation in applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability. A remote non-authenticated attacker can use a specially crafted X.509 certificate to bypass authentication process and gain unauthorized access to the application.


2) Deserialization of Untrusted Data (CVE-ID: CVE-2022-42003)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insecure input validation when processing serialized data when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. A remote attacker can pass specially crafted data to the application and cause a denial of service condition on the target system.


Remediation

Install update from vendor's website.

References