Improper input validation in Oracle Application Testing Suite - CVE-2019-2904

Vulnerability identifier: #VU24597

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-2904

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Load Testing for Web Apps (Application Development Framework) component in Oracle Application Testing Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Oracle Application Testing Suite
Oracle Banking Platform
Oracle Communications Service Broker
Oracle FLEXCUBE Private Banking
Oracle Financial Services Lending and Leasing
Oracle Retail Clearance Optimization Engine
Oracle Health Sciences Data Management Workbench
Oracle Financial Services Revenue Management and Billing Analytics
Oracle Banking Enterprise Originations
Oracle Banking Enterprise Collections
Oracle Banking Enterprise Product Manufacturing
Oracle Clinical
Oracle Communications Network Integrity
Oracle Communications Diameter Signaling Router (DSR)
Oracle Rapid Planning
Oracle Communications Services Gatekeeper
Oracle Enterprise Repository
Oracle Business Process Management Suite
Oracle JDeveloper
Hyperion Planning
Oracle Retail Sales Audit
Oracle Retail Markdown Optimization
Oracle Retail Assortment Planning

Install updates from vendor's website.

• https://www.oracle.com/security-alerts/cpujan2020.html

• Multiple vulnerabilities in Oracle Application Testing Suite
• Improper input validation in Oracle Communications Service Broker
• Improper input validation in Oracle Communications Services Gatekeeper
• Improper input validation in Oracle Banking Enterprise Collections
• Multiple vulnerabilities in Oracle Banking Enterprise Originations
• Multiple vulnerabilities in Oracle Banking Enterprise Product Manufacturing
• Multiple vulnerabilities in Oracle Banking Platform
• Improper input validation in Oracle Financial Services Revenue Management and Billing Analytics
• Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
• Improper input validation in Oracle Retail Sales Audit
• Multiple vulnerabilities in Oracle Retail Assortment Planning
• Improper input validation in Hyperion Planning
• Improper input validation in Oracle Health Sciences Data Management Workbench
• Improper input validation in Oracle Clinical
• Multiple vulnerabilities in Oracle Retail Markdown Optimization
• Multiple vulnerabilities in Oracle Retail Clearance Optimization Engine
• Multiple vulnerabilities in Oracle JDeveloper and ADF
• Multiple vulnerabilities in Oracle Communications Network Integrity
• Multiple vulnerabilities in Oracle Financial Services Lending and Leasing
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router (DSR)
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Improper input validation in Oracle Enterprise Repository
• Improper input validation in Oracle Rapid Planning