Oracle WebLogic Server 10.3.6.0.0/12.1.3.0.0/12.2.1.3.0 OpenSSL access control

Summaryinfo

A vulnerability classified as critical was found in Oracle WebLogic Server 10.3.6.0.0/12.1.3.0.0/12.2.1.3.0. This impacts an unknown function of the component OpenSSL. Such manipulation leads to access control. This vulnerability is documented as CVE-2019-2824. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Oracle WebLogic Server 10.3.6.0.0/12.1.3.0.0/12.2.1.3.0 (Application Server Software). Affected by this issue is an unknown function of the component OpenSSL. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, and integrity. CVE summarizes:

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N).

The weakness was released 07/16/2019 as Oracle Critical Patch Update Advisory - Juli 2019 as confirmed advisory (Website). The advisory is available at oracle.com. This vulnerability is handled as CVE-2019-2824 since 12/14/2018. The attack may be launched remotely. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-137972, VDB-137963, VDB-137964 and VDB-137965. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Application Server Software

Vendor

• Oracle

Name

• WebLogic Server

Version

• 10.3.6.0.0
• 12.1.3.0.0
• 12.2.1.3.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion