Improper input validation in Oracle Knowledge - CVE-2015-0254

Vulnerability identifier: #VU27250

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-0254

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Information Manager Console (Apache Standard Taglibs) component in Oracle Knowledge. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Oracle Knowledge
Amazon Linux AMI
SUSE Linux
IBM Sterling B2B Integrator
Oracle WebLogic Server
Jazz Reporting Service
IBM Qradar SIEM
IBM Engineering Requirements Management DOORS Next

Install updates from vendor's website.

Oracle Knowledge - update to 8.6.2
IBM Sterling B2B Integrator - addressed in versions 6.0.3.5, 6.1.1.0
Jazz Reporting Service - update to 7.0.2 iFix022
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7

• https://www.oracle.com/security-alerts/cpuapr2020.html

• Multiple vulnerabilities in Oracle Knowledge
• Amazon Linux AMI update for jakarta-taglibs-standard
• SUSE Linux update for jakarta-taglibs-standard
• SUSE Linux update for jakarta-taglibs-standard
• Multiple vulnerabilities in Oracle WebLogic Server
• Improper input validation in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM QRadar SIEM
• Improper input validation in IBM Jazz Reporting Service
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA