CVE-2010-3591 - Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.

CVE-2010-3591

Summary

Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Internal Operations. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can overwrite or delete arbitrary files via a full pathname in the second argument to the DownloadSingleMessageToFile method in the EMPOP3Lib ActiveX component (empop3.dll).

References

Vulnerable Configurations

cpe:2.3:a:oracle:fusion_middleware:10.1.3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:fusion_middleware:10.1.3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:fusion_middleware:10.1.3.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:fusion_middleware:10.1.3.5:*:*:*:*:*:*:*

CVSS

Base:	9.3 (as of 10-10-2018 - 20:04)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:C/I:C/A:C

refmap via4

bid	45851
bugtraq	20110125 [DSECRG-11-005] Oracle Document Capture empop3.dll - insecure method
confirm	http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
exploit-db	16055
misc	http://dsecrg.com/pages/vul/show.php?id=305
sectrack	1024981
secunia	42976
vupen	ADV-2011-0143
xf	oracle-document-internaloperations-code-exec(64768)

Last major update

10-10-2018 - 20:04

Published

19-01-2011 - 16:00

Last modified

10-10-2018 - 20:04