A vulnerability was found in Oracle Managed File Transfer 12.2.1.3.0/19.1.0.0.0 (File Transfer Software) and classified as critical. Affected by this issue is an unknown code of the component AntiSamy. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, and integrity.

The bug was discovered 01/15/2019. The weakness was published 01/16/2019 as Oracle Critical Patch Update Advisory - January 2019 as confirmed advisory (Website). The advisory is shared for download at oracle.com. This vulnerability is handled as CVE-2019-2538 since 12/14/2018. The attack may be launched remotely. A simple authentication is needed for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 106606†). Similar entries are available at VDB-125486, VDB-129551, VDB-129543 and VDB-129544. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• File Transfer Software

Vendor

• Oracle

Name

• Managed File Transfer

Version

• 12.2.1.3.0
• 19.1.0.0.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion