Oracle iPlanet Web Server 7.0.x Administration Console inadequate encryption

Summaryinfo

A vulnerability was found in Oracle iPlanet Web Server 7.0.x. It has been classified as problematic. This vulnerability affects unknown code of the component Administration Console. Performing a manipulation results in inadequate encryption. This vulnerability is identified as CVE-2020-9315. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in Oracle iPlanet Web Server 7.0.x (Web Server). This affects an unknown code block of the component Administration Console. The manipulation with an unknown input leads to a inadequate encryption vulnerability. CWE is classifying the issue as CWE-326. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. This is going to have an impact on confidentiality. The summary by CVE is:

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE.

The weakness was released 05/10/2020. This vulnerability is uniquely identified as CVE-2020-9315 since 02/20/2020. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/11/2020). The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entry connected to this vulnerability is available at VDB-154970. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Web Server

Vendor

• Oracle

Name

• iPlanet Web Server

Version

• 7.0.x

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion