Improper input validation in Oracle Communications Design Studio - CVE-2019-0227

Vulnerability identifier: #VU24468

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-0227

CWE-ID: CWE-20

Exploitation vector: Adjecent network

Exploit availability: Public exploit is available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Core (Apache Axis) component in Oracle Communications Design Studio. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Oracle Communications Design Studio
Oracle Real-Time Decision Server
Oracle Product Lifecycle Analytics
Oracle Communications ASAP Cartridges
Oracle Communications Network Integrity
Oracle Communications Session Report Manager
IBM Integration Bus
Enterprise Manager Base Platform
IBM Cloud Pak for Business Automation
Netcool Operations Insight
IBM Maximo Asset Management
IBM Maximo Application Suite
Oracle Big Data Discovery
Oracle Retail Xstore Point of Service
Oracle Financial Services Analytical Applications Infrastructure
Oracle Policy Automation Connector for Siebel
Oracle FLEXCUBE Private Banking
Oracle Tuxedo
Oracle BI Publisher
Oracle Business Intelligence Enterprise Edition
Oracle Application Testing Suite
Oracle Retail Order Broker
System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service (VSS)
Oracle Endeca Information Discovery Studio
Oracle Hospitality Guest Access
Oracle Communications Session Route Manager
Oracle Communications Element Manager
Oracle Knowledge
Oracle Secure Global Desktop
Oracle Communications Order and Service Management
Oracle Financial Services Funds Transfer Pricing
PeopleSoft Enterprise HCM Human Resources
Oracle WebCenter Portal
Instantis EnterpriseTrack
Oracle Financial Services Compliance Regulatory Reporting
PeopleSoft Enterprise PeopleTools
IBM Cognos Analytics
Oracle Agile PLM Framework
IBM App Connect Enterprise
Oracle Enterprise Manager for Fusion Middleware
Oracle Internet Directory
Primavera Unifier
Primavera Gateway

Install updates from vendor's website.

IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF007, 24.0.1-IF006, 25.0.0-IF003
Netcool Operations Insight - update to 1.6.9
System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service (VSS) - update to 4.19.1.3
IBM Maximo Asset Management - addressed in versions 7.6.1.2.0.29, 7.6.1.3.0.4
IBM Maximo Application Suite - update to 8.4.5
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2

• Exploit #6023 - Apache Axis 1.4 - Remote Code Execution (June 17, 2021)
• Exploit #2077 - CVEs (Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs) (March 18, 2020)

• https://www.oracle.com/security-alerts/cpujan2020.html

• Multiple vulnerabilities in Oracle Communications Design Studio
• Multiple vulnerabilities in Primavera Gateway
• Multiple vulnerabilities in Primavera Unifier
• Improper input validation in Oracle Financial Services Funds Transfer Pricing
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Improper input validation in Oracle Big Data Discovery
• Multiple vulnerabilities in Oracle Endeca Information Discovery Studio
• Improper input validation i nOracle Tuxedo
• Multiple vulnerabilities in Oracle Communications Element Manager
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Session Route Manager
• Improper input validation in Oracle Communications ASAP Cartridges
• Improper input validation in Oracle Application Testing Suite
• Multiple vulnerabilities in Oracle Knowledge
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
• Multiple vulnerabilities in Oracle Agile PLM Framework
• Multiple vulnerabilities in Oracle Retail Order Broker
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Secure Global Desktop
• Multiple vulnerabilities in Oracle Policy Automation Connector for Siebel
• Multiple vulnerabilities in Oracle Hospitality Guest Access
• Multiple vulnerabilities in Instantis EnterpriseTrack
• Multiple vulnerabilities in Oracle Communications Order and Service Management
• Multiple vulnerabilities in Oracle Communications Network Integrity
• Improper input validation in Oracle Enterprise Manager for Fusion Middleware
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Improper input validation in Oracle Financial Services Compliance Regulatory Reporting
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Oracle Real-Time Decision Server
• Multiple vulnerabilities in PeopleSoft Enterprise HCM Human Resources
• Multiple vulnerabilities in Siebel UI Framework
• Multiple vulnerabilities in Oracle Internet Directory
• Multiple vulnerabilities in Oracle BI Publisher
• Multiple vulnerabilities in Oracle Product Lifecycle Analytics
• Multiple vulnerabilities in IBM Maximo Asset Management and IBM Maximo Application Suite
• Multiple vulnerabilities in IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service (VSS)
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation