CVE-2019-2579

MEDIUMNuclei

Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-2579 has a selected CVSS score of 4.3 (medium); EIP currently links 1 Nuclei template.

Description

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 2, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WebCenter Sites

Browse Oracle Corporation / WebCenter Sites
CVE List12.2.1.3.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMOracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL InjectionCVSS 4.3

The Oracle WebCenter Sites component of Oracle Fusion Middleware 12.2.1.3.0 is susceptible to SQL injection via an easily exploitable vulnerability that allows low privileged attackers with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access, data manipulation, or denial of service.

Remediation

Apply the necessary patches or updates provided by Oracle to mitigate the SQL Injection vulnerability.

Authorsleovalcante
Template tagscvecve2019oraclewcssqlivuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CPE: cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
https://outpost24.com/blog/Vulnerabilities-discovered-in-Oracle-WebCenter-Sites https://github.com/Leovalcante/wcs_scanner https://nvd.nist.gov/vuln/detail/CVE-2019-2579 http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2