Improper input validation in Oracle Communications Unified Inventory Management - CVE-2019-17091

Vulnerability identifier: #VU24469

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-17091

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Maps (Mojarra) component in Oracle Communications Unified Inventory Management. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Oracle Communications Unified Inventory Management
Oracle Banking Enterprise Product Manufacturing
Oracle Healthcare Data Repository
Oracle Communications Network Integrity
Oracle Communications Diameter Signaling Router (DSR)
Oracle Enterprise Data Quality
Primavera P6 Enterprise Project Portfolio Management
Oracle Health Sciences Information Manager
Oracle Secure Global Desktop
Oracle WebLogic Server
Oracle Application Testing Suite
Oracle Retail Store Inventory Management
Oracle Retail Advanced Inventory Planning
Oracle Retail Merchandising System
Oracle Retail Assortment Planning
Oracle Retail Bulk Data Integration

Install updates from vendor's website.

• https://www.oracle.com/security-alerts/cpujan2020.html

• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Primavera P6 Enterprise Project Portfolio Management
• Improper input validation in Oracle Healthcare Data Repository
• Improper input validation in Oracle Health Sciences Information Manager
• Multiple vulnerabilities in Oracle Retail Advanced Inventory Planning
• Improper input validation in Oracle Retail Merchandising System
• Multiple vulnerabilities in Oracle Banking Enterprise Product Manufacturing
• Multiple vulnerabilities in Oracle Retail Assortment Planning
• Multiple vulnerabilities in Oracle Secure Global Desktop
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Communications Network Integrity
• Multiple vulnerabilities in Oracle Application Testing Suite
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router (DSR)
• Multiple vulnerabilities in Oracle Enterprise Data Quality
• Multiple vulnerabilities in Oracle Retail Store Inventory Management
• Multiple vulnerabilities in Oracle Retail Bulk Data Integration