Oracle WebCenter Interaction 10.3.3 AjaxControl input validation

Summaryinfo

A vulnerability was found in Oracle WebCenter Interaction 10.3.3. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component AjaxControl. The manipulation leads to input validation. This vulnerability is uniquely identified as CVE-2018-16956. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Oracle WebCenter Interaction 10.3.3 (Content Management System). This issue affects an unknown code block of the component AjaxControl. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is availability. The summary by CVE is:

The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename requests. Pages can be renamed to include characters unsupported for URIs by the web server hosting the WCI Portal software (such as IIS). Renaming pages to include unsupported characters, such as 0x7f, prevents these pages from being accessed over the web server, causing a Denial of Service (DoS) to the page.

The bug was discovered 09/16/2018. The weakness was disclosed 09/18/2018 (Website). The advisory is shared at securityfocus.com. The identification of this vulnerability is CVE-2018-16956 since 09/12/2018. The attack may be initiated remotely. The requirement for exploitation is a simple authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 03/24/2020).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 105350†). The entries VDB-124153, VDB-124154, VDB-124155 and VDB-124156 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• Oracle

Name

• WebCenter Interaction

Version

• 10.3.3

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion