CVE-2019-2578

HIGHNuclei

Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-2578 has a selected CVSS score of 8.6 (high); EIP currently links 1 Nuclei template.

Description

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 2, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WebCenter Sites

Browse Oracle Corporation / WebCenter Sites
CVE List12.2.1.3.0affected

Nuclei templates

1
ProjectDiscoveryHIGHOracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access ControlCVSS 8.6

Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data.

Impact

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information or perform unauthorized actions.

Remediation

Apply the necessary patches or updates provided by Oracle to fix the Broken Access Control vulnerability (CVE-2019-2578).

Authorsleovalcante
Template tagscvecve2019oraclewcsauth-bypassvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CPE: cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
https://www.oracle.com/security-alerts/cpuapr2019.html https://outpost24.com/blog/Vulnerabilities-discovered-in-Oracle-WebCenter-Sites https://nvd.nist.gov/vuln/detail/CVE-2019-2578 http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2