Improper input validation in Primavera Unifier - CVE-2019-14379

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28624

Improper input validation in Primavera Unifier - CVE-2019-14379

Published: June 4, 2020


Vulnerability identifier: #VU28624
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14379
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Core (jackson-databind) component in Primavera Unifier. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


Affected software

Primavera Unifier
Oracle Banking Platform
Oracle Retail Xstore Point of Service
Oracle Financial Services Analytical Applications Infrastructure
Primavera Gateway
Stream Analytics
Fedora
jackson-annotations
jackson-bom
jackson-core
jackson-databind

How to mitigate CVE-2019-14379

Install updates from vendor's website.

Oracle Financial Services Analytical Applications Infrastructure - update to 8.0.9
Stream Analytics - update to 19.1.0.0.1
jackson-annotations - addressed in versions 2.9.9-1.fc29, 2.9.9-1.fc30, 2.9.9-1.fc31
jackson-bom - addressed in versions 2.9.9-1.fc29, 2.9.9-1.fc30, 2.9.9-1.fc31
jackson-core - addressed in versions 2.9.9-1.fc29, 2.9.9-1.fc30, 2.9.9-1.fc31
jackson-databind - addressed in versions 2.9.9.3-1.fc29, 2.9.9.3-1.fc30, 2.9.9.3-1.fc31

External References

Related Security Bulletins