Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2016-1000031
Vulnerability from cvelistv5
Published
2016-10-25 14:00
Modified
2024-08-06 03:47
Severity ?
EPSS score ?
Summary
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T03:47:34.863Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "93604",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/93604"
},
{
"name": "[announce] 20181105 [SECURITY] Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E"
},
{
"name": "[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E"
},
{
"name": "openSUSE-SU-2019:1399",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20190212-0001/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.apache.org/jira/browse/WW-4812"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-16-570/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2016-30"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2016-12"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.apache.org/jira/browse/FILEUPLOAD-279"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2016-23"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-04-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-22T17:57:30",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "93604",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/93604"
},
{
"name": "[announce] 20181105 [SECURITY] Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E"
},
{
"name": "[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E"
},
{
"name": "openSUSE-SU-2019:1399",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20190212-0001/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.apache.org/jira/browse/WW-4812"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-16-570/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2016-30"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2016-12"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.apache.org/jira/browse/FILEUPLOAD-279"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2016-23"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-1000031",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "93604",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/93604"
},
{
"name": "[announce] 20181105 [SECURITY] Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E"
},
{
"name": "[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E"
},
{
"name": "openSUSE-SU-2019:1399",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
"refsource": "CONFIRM",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"refsource": "MISC",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"refsource": "MISC",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"refsource": "MISC",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"name": "https://security.netapp.com/advisory/ntap-20190212-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20190212-0001/"
},
{
"name": "https://issues.apache.org/jira/browse/WW-4812",
"refsource": "CONFIRM",
"url": "https://issues.apache.org/jira/browse/WW-4812"
},
{
"name": "http://www.zerodayinitiative.com/advisories/ZDI-16-570/",
"refsource": "MISC",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-16-570/"
},
{
"name": "https://www.tenable.com/security/research/tra-2016-30",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2016-30"
},
{
"name": "https://www.tenable.com/security/research/tra-2016-12",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2016-12"
},
{
"name": "https://issues.apache.org/jira/browse/FILEUPLOAD-279",
"refsource": "CONFIRM",
"url": "https://issues.apache.org/jira/browse/FILEUPLOAD-279"
},
{
"name": "https://www.tenable.com/security/research/tra-2016-23",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2016-23"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "MISC",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2022.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-1000031",
"datePublished": "2016-10-25T14:00:00",
"dateReserved": "2016-09-22T00:00:00",
"dateUpdated": "2024-08-06T03:47:34.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2016-1000031\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2016-10-25T14:29:00.180\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution\"},{\"lang\":\"es\",\"value\":\"Apache Commons FileUpload versi\u00f3n anterior a 1.3.3, la manipulaci\u00f3n del archivo DiskFileItem conduce a la ejecuci\u00f3n de c\u00f3digo remota.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":true,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.3.2\",\"matchCriteriaId\":\"7A6FC4C5-ADA8-44B0-80B3-672B0025BF3C\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/93604\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.zerodayinitiative.com/advisories/ZDI-16-570/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://issues.apache.org/jira/browse/FILEUPLOAD-279\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://issues.apache.org/jira/browse/WW-4812\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20190212-0001/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2020.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2022.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.tenable.com/security/research/tra-2016-12\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/research/tra-2016-23\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/research/tra-2016-30\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/93604\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.zerodayinitiative.com/advisories/ZDI-16-570/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://issues.apache.org/jira/browse/FILEUPLOAD-279\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://issues.apache.org/jira/browse/WW-4812\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20190212-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.tenable.com/security/research/tra-2016-12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/research/tra-2016-23\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/research/tra-2016-30\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}],\"evaluatorComment\":\"Per Apache: \\\"Having reviewed your report we have concluded that it does not represent a valid vulnerability in Apache Commons File Upload. If an application deserializes data from an untrusted source without filtering and/or validation that is an application vulnerability not a vulnerability in the library a potential attacker might leverage.\\\"\"}}"
}
}
suse-su-2019:1214-1
Vulnerability from csaf_suse
Published
2019-05-10 12:13
Modified
2019-05-10 12:13
Summary
Security update for jakarta-commons-fileupload
Notes
Title of the patch
Security update for jakarta-commons-fileupload
Description of the patch
This update for jakarta-commons-fileupload fixes the following issue:
Security issue fixed:
- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).
Patchnames
SUSE-2019-1214,SUSE-OpenStack-Cloud-7-2019-1214,SUSE-SLE-SAP-12-SP1-2019-1214,SUSE-SLE-SAP-12-SP2-2019-1214,SUSE-SLE-SERVER-12-2019-1214,SUSE-SLE-SERVER-12-SP1-2019-1214,SUSE-SLE-SERVER-12-SP2-2019-1214,SUSE-SLE-SERVER-12-SP2-BCL-2019-1214,SUSE-SLE-SERVER-12-SP3-2019-1214,SUSE-SLE-SERVER-12-SP4-2019-1214,SUSE-Storage-4-2019-1214
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for jakarta-commons-fileupload",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for jakarta-commons-fileupload fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2019-1214,SUSE-OpenStack-Cloud-7-2019-1214,SUSE-SLE-SAP-12-SP1-2019-1214,SUSE-SLE-SAP-12-SP2-2019-1214,SUSE-SLE-SERVER-12-2019-1214,SUSE-SLE-SERVER-12-SP1-2019-1214,SUSE-SLE-SERVER-12-SP2-2019-1214,SUSE-SLE-SERVER-12-SP2-BCL-2019-1214,SUSE-SLE-SERVER-12-SP3-2019-1214,SUSE-SLE-SERVER-12-SP4-2019-1214,SUSE-Storage-4-2019-1214",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1214-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2019:1214-1",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191214-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2019:1214-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2019-May/005433.html"
},
{
"category": "self",
"summary": "SUSE Bug 1128829",
"url": "https://bugzilla.suse.com/1128829"
},
{
"category": "self",
"summary": "SUSE Bug 1128963",
"url": "https://bugzilla.suse.com/1128963"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1000031 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1000031/"
}
],
"title": "Security update for jakarta-commons-fileupload",
"tracking": {
"current_release_date": "2019-05-10T12:13:23Z",
"generator": {
"date": "2019-05-10T12:13:23Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2019:1214-1",
"initial_release_date": "2019-05-10T12:13:23Z",
"revision_history": [
{
"date": "2019-05-10T12:13:23Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"product": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"product_id": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
}
},
{
"category": "product_version",
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"product": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"product_id": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 7",
"product": {
"name": "SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP1-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP2-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-bcl:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP3",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP3",
"product_id": "SUSE Linux Enterprise Server 12 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP4",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP4",
"product_id": "SUSE Linux Enterprise Server 12 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Enterprise Storage 4",
"product": {
"name": "SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
"product_id": "SUSE Linux Enterprise Server 12 SP3:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
"product_id": "SUSE Linux Enterprise Server 12 SP3:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP4",
"product_id": "SUSE Linux Enterprise Server 12 SP4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP4",
"product_id": "SUSE Linux Enterprise Server 12 SP4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-1000031",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1000031"
}
],
"notes": [
{
"category": "general",
"text": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Enterprise Storage 4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP1-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP1-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-BCL:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-BCL:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP3:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP3:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE OpenStack Cloud 7:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE OpenStack Cloud 7:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1000031",
"url": "https://www.suse.com/security/cve/CVE-2016-1000031"
},
{
"category": "external",
"summary": "SUSE Bug 1128963 for CVE-2016-1000031",
"url": "https://bugzilla.suse.com/1128963"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Enterprise Storage 4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP1-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP1-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-BCL:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-BCL:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP3:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP3:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE OpenStack Cloud 7:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE OpenStack Cloud 7:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Enterprise Storage 4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP1-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP1-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-BCL:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-BCL:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP2-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP3:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP3:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12 SP4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12-LTSS:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server 12-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch",
"SUSE OpenStack Cloud 7:jakarta-commons-fileupload-1.1.1-122.3.1.noarch",
"SUSE OpenStack Cloud 7:jakarta-commons-fileupload-javadoc-1.1.1-122.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-05-10T12:13:23Z",
"details": "critical"
}
],
"title": "CVE-2016-1000031"
}
]
}
suse-su-2019:1212-2
Vulnerability from csaf_suse
Published
2019-10-11 15:06
Modified
2019-10-11 15:06
Summary
Security update for jakarta-commons-fileupload
Notes
Title of the patch
Security update for jakarta-commons-fileupload
Description of the patch
This update for jakarta-commons-fileupload fixes the following issue:
Security issue fixed:
- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).
Patchnames
SUSE-2019-1212,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-1212,SUSE-SLE-Module-Web-Scripting-15-SP1-2019-1212
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for jakarta-commons-fileupload",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for jakarta-commons-fileupload fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2019-1212,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-1212,SUSE-SLE-Module-Web-Scripting-15-SP1-2019-1212",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1212-2.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2019:1212-2",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191212-2/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2019:1212-2",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2019-October/006004.html"
},
{
"category": "self",
"summary": "SUSE Bug 1128829",
"url": "https://bugzilla.suse.com/1128829"
},
{
"category": "self",
"summary": "SUSE Bug 1128963",
"url": "https://bugzilla.suse.com/1128963"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1000031 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1000031/"
}
],
"title": "Security update for jakarta-commons-fileupload",
"tracking": {
"current_release_date": "2019-10-11T15:06:57Z",
"generator": {
"date": "2019-10-11T15:06:57Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2019:1212-2",
"initial_release_date": "2019-10-11T15:06:57Z",
"revision_history": [
{
"date": "2019-10-11T15:06:57Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "jakarta-commons-fileupload-1.1.1-4.3.1.noarch",
"product": {
"name": "jakarta-commons-fileupload-1.1.1-4.3.1.noarch",
"product_id": "jakarta-commons-fileupload-1.1.1-4.3.1.noarch"
}
},
{
"category": "product_version",
"name": "jakarta-commons-fileupload-javadoc-1.1.1-4.3.1.noarch",
"product": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-4.3.1.noarch",
"product_id": "jakarta-commons-fileupload-javadoc-1.1.1-4.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP1",
"product": {
"name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP1",
"product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-web-scripting:15:sp1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-4.3.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1",
"product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:jakarta-commons-fileupload-1.1.1-4.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-4.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-1000031",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1000031"
}
],
"notes": [
{
"category": "general",
"text": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Web and Scripting 15 SP1:jakarta-commons-fileupload-1.1.1-4.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1000031",
"url": "https://www.suse.com/security/cve/CVE-2016-1000031"
},
{
"category": "external",
"summary": "SUSE Bug 1128963 for CVE-2016-1000031",
"url": "https://bugzilla.suse.com/1128963"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Web and Scripting 15 SP1:jakarta-commons-fileupload-1.1.1-4.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Web and Scripting 15 SP1:jakarta-commons-fileupload-1.1.1-4.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-10-11T15:06:57Z",
"details": "critical"
}
],
"title": "CVE-2016-1000031"
}
]
}
suse-su-2019:14044-1
Vulnerability from csaf_suse
Published
2019-05-10 12:11
Modified
2019-05-10 12:11
Summary
Security update for jakarta-commons-fileupload
Notes
Title of the patch
Security update for jakarta-commons-fileupload
Description of the patch
This update for jakarta-commons-fileupload fixes the following issue:
Security issue fixed:
- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).
Patchnames
sleposp3-jakarta-commons-fileupload-14044,slessp4-jakarta-commons-fileupload-14044
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for jakarta-commons-fileupload",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for jakarta-commons-fileupload fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sleposp3-jakarta-commons-fileupload-14044,slessp4-jakarta-commons-fileupload-14044",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_14044-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2019:14044-1",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914044-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2019:14044-1",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914044-1.html"
},
{
"category": "self",
"summary": "SUSE Bug 1128829",
"url": "https://bugzilla.suse.com/1128829"
},
{
"category": "self",
"summary": "SUSE Bug 1128963",
"url": "https://bugzilla.suse.com/1128963"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1000031 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1000031/"
}
],
"title": "Security update for jakarta-commons-fileupload",
"tracking": {
"current_release_date": "2019-05-10T12:11:18Z",
"generator": {
"date": "2019-05-10T12:11:18Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2019:14044-1",
"initial_release_date": "2019-05-10T12:11:18Z",
"revision_history": [
{
"date": "2019-05-10T12:11:18Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch",
"product": {
"name": "jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch",
"product_id": "jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch"
}
},
{
"category": "product_version",
"name": "jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch",
"product": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch",
"product_id": "jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product": {
"name": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product_id": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-pos:11:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles:11:sp4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch as component of SUSE Linux Enterprise Point of Sale 11 SP3",
"product_id": "SUSE Linux Enterprise Point of Sale 11 SP3:jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Point of Sale 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch as component of SUSE Linux Enterprise Point of Sale 11 SP3",
"product_id": "SUSE Linux Enterprise Point of Sale 11 SP3:jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Point of Sale 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-1000031",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1000031"
}
],
"notes": [
{
"category": "general",
"text": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch",
"SUSE Linux Enterprise Point of Sale 11 SP3:jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch",
"SUSE Linux Enterprise Server 11 SP4-LTSS:jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch",
"SUSE Linux Enterprise Server 11 SP4-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1000031",
"url": "https://www.suse.com/security/cve/CVE-2016-1000031"
},
{
"category": "external",
"summary": "SUSE Bug 1128963 for CVE-2016-1000031",
"url": "https://bugzilla.suse.com/1128963"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch",
"SUSE Linux Enterprise Point of Sale 11 SP3:jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch",
"SUSE Linux Enterprise Server 11 SP4-LTSS:jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch",
"SUSE Linux Enterprise Server 11 SP4-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch",
"SUSE Linux Enterprise Point of Sale 11 SP3:jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch",
"SUSE Linux Enterprise Server 11 SP4-LTSS:jakarta-commons-fileupload-1.1.1-1.37.3.1.noarch",
"SUSE Linux Enterprise Server 11 SP4-LTSS:jakarta-commons-fileupload-javadoc-1.1.1-1.37.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-05-10T12:11:18Z",
"details": "critical"
}
],
"title": "CVE-2016-1000031"
}
]
}
suse-su-2019:1212-1
Vulnerability from csaf_suse
Published
2019-05-10 12:10
Modified
2019-05-10 12:10
Summary
Security update for jakarta-commons-fileupload
Notes
Title of the patch
Security update for jakarta-commons-fileupload
Description of the patch
This update for jakarta-commons-fileupload fixes the following issue:
Security issue fixed:
- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).
Patchnames
SUSE-2019-1212,SUSE-SLE-Module-Development-Tools-OBS-15-2019-1212,SUSE-SLE-Module-Web-Scripting-15-2019-1212
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for jakarta-commons-fileupload",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for jakarta-commons-fileupload fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2019-1212,SUSE-SLE-Module-Development-Tools-OBS-15-2019-1212,SUSE-SLE-Module-Web-Scripting-15-2019-1212",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1212-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2019:1212-1",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191212-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2019:1212-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2019-May/005434.html"
},
{
"category": "self",
"summary": "SUSE Bug 1128829",
"url": "https://bugzilla.suse.com/1128829"
},
{
"category": "self",
"summary": "SUSE Bug 1128963",
"url": "https://bugzilla.suse.com/1128963"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1000031 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1000031/"
}
],
"title": "Security update for jakarta-commons-fileupload",
"tracking": {
"current_release_date": "2019-05-10T12:10:15Z",
"generator": {
"date": "2019-05-10T12:10:15Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2019:1212-1",
"initial_release_date": "2019-05-10T12:10:15Z",
"revision_history": [
{
"date": "2019-05-10T12:10:15Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "jakarta-commons-fileupload-1.1.1-4.3.1.noarch",
"product": {
"name": "jakarta-commons-fileupload-1.1.1-4.3.1.noarch",
"product_id": "jakarta-commons-fileupload-1.1.1-4.3.1.noarch"
}
},
{
"category": "product_version",
"name": "jakarta-commons-fileupload-javadoc-1.1.1-4.3.1.noarch",
"product": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-4.3.1.noarch",
"product_id": "jakarta-commons-fileupload-javadoc-1.1.1-4.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Web and Scripting 15",
"product": {
"name": "SUSE Linux Enterprise Module for Web and Scripting 15",
"product_id": "SUSE Linux Enterprise Module for Web and Scripting 15",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-web-scripting:15"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-4.3.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15",
"product_id": "SUSE Linux Enterprise Module for Web and Scripting 15:jakarta-commons-fileupload-1.1.1-4.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-4.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-1000031",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1000031"
}
],
"notes": [
{
"category": "general",
"text": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Web and Scripting 15:jakarta-commons-fileupload-1.1.1-4.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1000031",
"url": "https://www.suse.com/security/cve/CVE-2016-1000031"
},
{
"category": "external",
"summary": "SUSE Bug 1128963 for CVE-2016-1000031",
"url": "https://bugzilla.suse.com/1128963"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Web and Scripting 15:jakarta-commons-fileupload-1.1.1-4.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Web and Scripting 15:jakarta-commons-fileupload-1.1.1-4.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-05-10T12:10:15Z",
"details": "critical"
}
],
"title": "CVE-2016-1000031"
}
]
}
wid-sec-w-2024-1682
Vulnerability from csaf_certbund
Published
2019-04-16 22:00
Modified
2024-07-21 22:00
Summary
Oracle Retail Applications: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Oracle Retail Allocation ist ein Verwaltungswerkzeug.
Oracle MICROS bietet eine Reihe von Software, Hardware und Dienstleistungen zusammen mit schnell wachsenden Cloud Lösungen für Abrechnung und Verwaltung in Unternehmen des Hotel- und Gaststättengewerbes, Reiseveranstalter und Veranstaltern von Kreuzfahrten sowie in Unternehmen der Freizeit- und Unterhaltungsbranche.
Oracle Invoice Matching ist ein Tool zum Verwalten von Lieferantenrechnungen.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
Betroffene Betriebssysteme
- Linux
- UNIX
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Oracle Retail Allocation ist ein Verwaltungswerkzeug.\r\nOracle MICROS bietet eine Reihe von Software, Hardware und Dienstleistungen zusammen mit schnell wachsenden Cloud L\u00f6sungen f\u00fcr Abrechnung und Verwaltung in Unternehmen des Hotel- und Gastst\u00e4ttengewerbes, Reiseveranstalter und Veranstaltern von Kreuzfahrten sowie in Unternehmen der Freizeit- und Unterhaltungsbranche.\r\nOracle Invoice Matching ist ein Tool zum Verwalten von Lieferantenrechnungen.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um dadurch die Integrit\u00e4t, Vertraulichkeit und Verf\u00fcgbarkeit zu gef\u00e4hrden.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-1682 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2019/wid-sec-w-2024-1682.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-1682 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1682"
},
{
"category": "external",
"summary": "Oracle Critical Patch Update Advisory - April 2019 vom 2019-04-16",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html#AppendixRAPP"
},
{
"category": "external",
"summary": "NetApp Security Advisory NTAP-20240719-0002 vom 2024-07-19",
"url": "https://security.netapp.com/advisory/ntap-20240719-0002/"
}
],
"source_lang": "en-US",
"title": "Oracle Retail Applications: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-07-21T22:00:00.000+00:00",
"generator": {
"date": "2024-08-15T18:11:37.885+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2024-1682",
"initial_release_date": "2019-04-16T22:00:00.000+00:00",
"revision_history": [
{
"date": "2019-04-16T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2024-07-21T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von NetApp aufgenommen"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "NetApp ActiveIQ Unified Manager",
"product": {
"name": "NetApp ActiveIQ Unified Manager",
"product_id": "T034125",
"product_identification_helper": {
"cpe": "cpe:/a:netapp:active_iq_unified_manager:-"
}
}
}
],
"category": "vendor",
"name": "NetApp"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "15.0.2",
"product": {
"name": "Oracle Retail Allocation 15.0.2",
"product_id": "T014004",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_allocation:15.0.2"
}
}
}
],
"category": "product_name",
"name": "Retail Allocation"
},
{
"branches": [
{
"category": "product_version",
"name": "12",
"product": {
"name": "Oracle Retail Invoice Matching 12.0",
"product_id": "T001982",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:12.0"
}
}
},
{
"category": "product_version",
"name": "13",
"product": {
"name": "Oracle Retail Invoice Matching 13.0",
"product_id": "T001985",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:13.0"
}
}
},
{
"category": "product_version",
"name": "13.2",
"product": {
"name": "Oracle Retail Invoice Matching 13.2",
"product_id": "T001987",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:13.2"
}
}
},
{
"category": "product_version",
"name": "14",
"product": {
"name": "Oracle Retail Invoice Matching 14.0",
"product_id": "T004005",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:14.0"
}
}
},
{
"category": "product_version",
"name": "13.1",
"product": {
"name": "Oracle Retail Invoice Matching 13.1",
"product_id": "T004011",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:13.1"
}
}
},
{
"category": "product_version",
"name": "15",
"product": {
"name": "Oracle Retail Invoice Matching 15.0",
"product_id": "T012089",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:15.0"
}
}
},
{
"category": "product_version",
"name": "14.1",
"product": {
"name": "Oracle Retail Invoice Matching 14.1",
"product_id": "T014012",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:14.1"
}
}
}
],
"category": "product_name",
"name": "Retail Invoice Matching"
},
{
"branches": [
{
"category": "product_version",
"name": "2.9.5.6",
"product": {
"name": "Oracle Retail MICROS 2.9.5.6",
"product_id": "T014005",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:micros:2.9.5.6"
}
}
},
{
"category": "product_version",
"name": "2.9.5.7",
"product": {
"name": "Oracle Retail MICROS 2.9.5.7",
"product_id": "T014006",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:micros:2.9.5.7"
}
}
},
{
"category": "product_version",
"name": "11.4",
"product": {
"name": "Oracle Retail MICROS 11.4",
"product_id": "T014007",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:micros:11.4"
}
}
},
{
"category": "product_version",
"name": "12.1.2",
"product": {
"name": "Oracle Retail MICROS 12.1.2",
"product_id": "T014008",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:micros:12.1.2"
}
}
}
],
"category": "product_name",
"name": "Retail MICROS"
},
{
"branches": [
{
"category": "product_version",
"name": "1.60.9.0.0",
"product": {
"name": "Oracle Retail Workforce Management 1.60.9.0.0",
"product_id": "T014013",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_workforce_management:1.60.9.0.0"
}
}
}
],
"category": "product_name",
"name": "Retail Workforce Management"
},
{
"branches": [
{
"category": "product_version",
"name": "7",
"product": {
"name": "Oracle Retail Xstore Point of Service 7.0",
"product_id": "T012096",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_point-of-service:7.0"
}
}
},
{
"category": "product_version",
"name": "7.1",
"product": {
"name": "Oracle Retail Xstore Point of Service 7.1",
"product_id": "T012099",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_point-of-service:7.1"
}
}
}
],
"category": "product_name",
"name": "Retail Xstore Point of Service"
}
],
"category": "vendor",
"name": "Oracle"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-9515",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2014-9515"
},
{
"cve": "CVE-2015-9251",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2015-9251"
},
{
"cve": "CVE-2016-1000031",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2016-1000031"
},
{
"cve": "CVE-2017-5533",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2017-5533"
},
{
"cve": "CVE-2018-1000180",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-1000180"
},
{
"cve": "CVE-2018-1000613",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-1000613"
},
{
"cve": "CVE-2018-11763",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-11763"
},
{
"cve": "CVE-2018-11784",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-11784"
},
{
"cve": "CVE-2018-12022",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-12022"
},
{
"cve": "CVE-2018-12023",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-12023"
},
{
"cve": "CVE-2018-1304",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-1304"
},
{
"cve": "CVE-2018-1305",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-1305"
},
{
"cve": "CVE-2018-14718",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-14718"
},
{
"cve": "CVE-2018-14719",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-14719"
},
{
"cve": "CVE-2018-14720",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-14720"
},
{
"cve": "CVE-2018-14721",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-14721"
},
{
"cve": "CVE-2018-15756",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-15756"
},
{
"cve": "CVE-2018-19360",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-19360"
},
{
"cve": "CVE-2018-19361",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-19361"
},
{
"cve": "CVE-2018-19362",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-19362"
},
{
"cve": "CVE-2018-2880",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-2880"
},
{
"cve": "CVE-2018-3120",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-3120"
},
{
"cve": "CVE-2018-3312",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-3312"
},
{
"cve": "CVE-2018-3314",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-3314"
},
{
"cve": "CVE-2018-7489",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-7489"
},
{
"cve": "CVE-2018-8034",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-8034"
},
{
"cve": "CVE-2019-2424",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2019-2424"
},
{
"cve": "CVE-2019-2558",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2019-2558"
},
{
"cve": "CVE-2019-3772",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2019-3772"
}
]
}
WID-SEC-W-2024-1682
Vulnerability from csaf_certbund
Published
2019-04-16 22:00
Modified
2024-07-21 22:00
Summary
Oracle Retail Applications: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Oracle Retail Allocation ist ein Verwaltungswerkzeug.
Oracle MICROS bietet eine Reihe von Software, Hardware und Dienstleistungen zusammen mit schnell wachsenden Cloud Lösungen für Abrechnung und Verwaltung in Unternehmen des Hotel- und Gaststättengewerbes, Reiseveranstalter und Veranstaltern von Kreuzfahrten sowie in Unternehmen der Freizeit- und Unterhaltungsbranche.
Oracle Invoice Matching ist ein Tool zum Verwalten von Lieferantenrechnungen.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
Betroffene Betriebssysteme
- Linux
- UNIX
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Oracle Retail Allocation ist ein Verwaltungswerkzeug.\r\nOracle MICROS bietet eine Reihe von Software, Hardware und Dienstleistungen zusammen mit schnell wachsenden Cloud L\u00f6sungen f\u00fcr Abrechnung und Verwaltung in Unternehmen des Hotel- und Gastst\u00e4ttengewerbes, Reiseveranstalter und Veranstaltern von Kreuzfahrten sowie in Unternehmen der Freizeit- und Unterhaltungsbranche.\r\nOracle Invoice Matching ist ein Tool zum Verwalten von Lieferantenrechnungen.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um dadurch die Integrit\u00e4t, Vertraulichkeit und Verf\u00fcgbarkeit zu gef\u00e4hrden.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-1682 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2019/wid-sec-w-2024-1682.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-1682 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1682"
},
{
"category": "external",
"summary": "Oracle Critical Patch Update Advisory - April 2019 vom 2019-04-16",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html#AppendixRAPP"
},
{
"category": "external",
"summary": "NetApp Security Advisory NTAP-20240719-0002 vom 2024-07-19",
"url": "https://security.netapp.com/advisory/ntap-20240719-0002/"
}
],
"source_lang": "en-US",
"title": "Oracle Retail Applications: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-07-21T22:00:00.000+00:00",
"generator": {
"date": "2024-08-15T18:11:37.885+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2024-1682",
"initial_release_date": "2019-04-16T22:00:00.000+00:00",
"revision_history": [
{
"date": "2019-04-16T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2024-07-21T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von NetApp aufgenommen"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "NetApp ActiveIQ Unified Manager",
"product": {
"name": "NetApp ActiveIQ Unified Manager",
"product_id": "T034125",
"product_identification_helper": {
"cpe": "cpe:/a:netapp:active_iq_unified_manager:-"
}
}
}
],
"category": "vendor",
"name": "NetApp"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "15.0.2",
"product": {
"name": "Oracle Retail Allocation 15.0.2",
"product_id": "T014004",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_allocation:15.0.2"
}
}
}
],
"category": "product_name",
"name": "Retail Allocation"
},
{
"branches": [
{
"category": "product_version",
"name": "12",
"product": {
"name": "Oracle Retail Invoice Matching 12.0",
"product_id": "T001982",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:12.0"
}
}
},
{
"category": "product_version",
"name": "13",
"product": {
"name": "Oracle Retail Invoice Matching 13.0",
"product_id": "T001985",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:13.0"
}
}
},
{
"category": "product_version",
"name": "13.2",
"product": {
"name": "Oracle Retail Invoice Matching 13.2",
"product_id": "T001987",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:13.2"
}
}
},
{
"category": "product_version",
"name": "14",
"product": {
"name": "Oracle Retail Invoice Matching 14.0",
"product_id": "T004005",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:14.0"
}
}
},
{
"category": "product_version",
"name": "13.1",
"product": {
"name": "Oracle Retail Invoice Matching 13.1",
"product_id": "T004011",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:13.1"
}
}
},
{
"category": "product_version",
"name": "15",
"product": {
"name": "Oracle Retail Invoice Matching 15.0",
"product_id": "T012089",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:15.0"
}
}
},
{
"category": "product_version",
"name": "14.1",
"product": {
"name": "Oracle Retail Invoice Matching 14.1",
"product_id": "T014012",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_invoice_matching:14.1"
}
}
}
],
"category": "product_name",
"name": "Retail Invoice Matching"
},
{
"branches": [
{
"category": "product_version",
"name": "2.9.5.6",
"product": {
"name": "Oracle Retail MICROS 2.9.5.6",
"product_id": "T014005",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:micros:2.9.5.6"
}
}
},
{
"category": "product_version",
"name": "2.9.5.7",
"product": {
"name": "Oracle Retail MICROS 2.9.5.7",
"product_id": "T014006",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:micros:2.9.5.7"
}
}
},
{
"category": "product_version",
"name": "11.4",
"product": {
"name": "Oracle Retail MICROS 11.4",
"product_id": "T014007",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:micros:11.4"
}
}
},
{
"category": "product_version",
"name": "12.1.2",
"product": {
"name": "Oracle Retail MICROS 12.1.2",
"product_id": "T014008",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:micros:12.1.2"
}
}
}
],
"category": "product_name",
"name": "Retail MICROS"
},
{
"branches": [
{
"category": "product_version",
"name": "1.60.9.0.0",
"product": {
"name": "Oracle Retail Workforce Management 1.60.9.0.0",
"product_id": "T014013",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_workforce_management:1.60.9.0.0"
}
}
}
],
"category": "product_name",
"name": "Retail Workforce Management"
},
{
"branches": [
{
"category": "product_version",
"name": "7",
"product": {
"name": "Oracle Retail Xstore Point of Service 7.0",
"product_id": "T012096",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_point-of-service:7.0"
}
}
},
{
"category": "product_version",
"name": "7.1",
"product": {
"name": "Oracle Retail Xstore Point of Service 7.1",
"product_id": "T012099",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:retail_point-of-service:7.1"
}
}
}
],
"category": "product_name",
"name": "Retail Xstore Point of Service"
}
],
"category": "vendor",
"name": "Oracle"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-9515",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2014-9515"
},
{
"cve": "CVE-2015-9251",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2015-9251"
},
{
"cve": "CVE-2016-1000031",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2016-1000031"
},
{
"cve": "CVE-2017-5533",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2017-5533"
},
{
"cve": "CVE-2018-1000180",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-1000180"
},
{
"cve": "CVE-2018-1000613",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-1000613"
},
{
"cve": "CVE-2018-11763",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-11763"
},
{
"cve": "CVE-2018-11784",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-11784"
},
{
"cve": "CVE-2018-12022",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-12022"
},
{
"cve": "CVE-2018-12023",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-12023"
},
{
"cve": "CVE-2018-1304",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-1304"
},
{
"cve": "CVE-2018-1305",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-1305"
},
{
"cve": "CVE-2018-14718",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-14718"
},
{
"cve": "CVE-2018-14719",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-14719"
},
{
"cve": "CVE-2018-14720",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-14720"
},
{
"cve": "CVE-2018-14721",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-14721"
},
{
"cve": "CVE-2018-15756",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-15756"
},
{
"cve": "CVE-2018-19360",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-19360"
},
{
"cve": "CVE-2018-19361",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-19361"
},
{
"cve": "CVE-2018-19362",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-19362"
},
{
"cve": "CVE-2018-2880",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-2880"
},
{
"cve": "CVE-2018-3120",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-3120"
},
{
"cve": "CVE-2018-3312",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-3312"
},
{
"cve": "CVE-2018-3314",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-3314"
},
{
"cve": "CVE-2018-7489",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-7489"
},
{
"cve": "CVE-2018-8034",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2018-8034"
},
{
"cve": "CVE-2019-2424",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2019-2424"
},
{
"cve": "CVE-2019-2558",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2019-2558"
},
{
"cve": "CVE-2019-3772",
"notes": [
{
"category": "description",
"text": "In Oracle Retail Applications existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Authentifizierung und keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"High\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" und bewirkt damit eine \"hohe\" Schadensh\u00f6he."
}
],
"product_status": {
"known_affected": [
"T004011",
"T004005",
"T014007",
"T014008",
"T014005",
"T014006",
"T012089",
"T014004",
"T014012",
"T034125",
"T012099",
"T014013",
"T012096",
"T001987",
"T001985",
"T001982"
]
},
"release_date": "2019-04-16T22:00:00.000+00:00",
"title": "CVE-2019-3772"
}
]
}
cisco-sa-20181107-struts-commons-fileupload
Vulnerability from csaf_cisco
Published
2018-11-07 00:00
Modified
2019-02-07 14:49
Summary
Apache Struts Commons FileUpload Library Remote Code Execution Vulnerability Affecting Cisco Products: November 2018
Notes
Summary
On November 5, 2018, the Apache Struts Team released a security announcement urging an upgrade of the Commons FileUpload library to version 1.3.3 on systems using Struts 2.3.36 or earlier releases. Systems using earlier versions of this library may be exposed to attacks that could allow execution of arbitrary code or modifications of files on the system. The issue is caused by a previously reported vulnerability of the Apache Commons FileUpload library, assigned to CVE-2016-1000031.
The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by submitting crafted data to an affected system. A successful exploit could allow the attacker to execute arbitrary code or manipulate files on the targeted system.
Affected Products
Cisco investigated its product line to determine which products and services may be affected by this vulnerability.
The Vulnerable Products ["#vp"] section of this advisory includes Cisco bug IDs for each affected product or service. The bugs are accessible through the Cisco Bug Search Tool ["https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"] and contain additional platform-specific information, including workarounds (if available) and fixed software releases.
Any product or service not listed in the “Vulnerable Products” section of this advisory is to be considered not vulnerable.
Vulnerable Products
The following table lists Cisco products and services that are affected by the vulnerability that is described in this advisory. The software availability dates in the Fixed Release Availability column are estimates, and actual software availability may differ from the dates provided in the following table.
Product Cisco Bug ID Fixed Release Availability Collaboration and Social Media Cisco SocialMiner CSCvn22343 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22343"] Patch file available for 11.5/11.6 by Dec 2018
12.0.1 (Jan 2019) Cisco Webex Meetings Server CSCvn18895 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18895"] 2.8MR3 Security Patch 1 (Dec 2018)
3.0MR2 Security Patch 2 (Dec 2018) Endpoint Clients and Client Software Cisco Webex Management - SuperAdmin Control Panel CSCvn18901 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18901"] T33.7.2 (Dec 2018) Network and Content Security Devices Cisco Identity Services Engine (ISE) CSCvn17524 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn17524"] Hot patch available for 2.1 Patch 7/2.3 Patch 5
2.2 Patch 12 (Nov 2018)
2.3 Patch 6 (Feb 2019)
2.4 Patch 5 (Nov 2018)
2.5 (Dec 2018) Cisco Secure Access Control System (ACS) CSCvn18934 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18934"] No fix planned 1 Network Management and Provisioning Cisco Evolved Programmable Network Manager CSCvn44132 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn44132"] 2.2.1.2 (Dec 2018) Cisco Prime Collaboration Provisioning CSCvn18919 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18919"] 12.6 (Nov 2018) Cisco Prime Infrastructure CSCvn18917 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18917"] 3.3.1 Update 04 (Feb 2019)
3.4.1 Update 03 (Mar 2019)
3.5 (Dec 2018) Cisco Prime License Manager CSCvn18924 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18924"] Patch file available for 10.5.2/11.5.1 by Dec 2018 Cisco Prime Network Registrar IP Address Manager (IPAM) CSCvn18913 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18913"] No fix planned Cisco Prime Network CSCvn18910 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18910"] Patch file available for 5.1 by Dec 2018
5.2 (May 2019) Cisco Prime Service Catalog CSCvn22307 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22307"] 12.1 v7 Patch (Dec 2018) Routing and Switching - Enterprise and Service Provider Cisco IOx Fog Director CSCvn19758 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn19758"] 1.7.1 (Jan 2019)
1.8 (Feb 2019) Cisco IoT Field Network Director (formerly Cisco Connected Grid Network Management System) CSCvn20600 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn20600"] 4.3.2 (Dec 2018) Voice and Unified Communications Devices Cisco Emergency Responder CSCvn18956 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18956"] Patch file available for 11.5.1/12.0.1 by Dec 2018
12.5.1 (Jan 2019) Cisco Enterprise Chat and Email CSCvn18957 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18957"] 11.6 ES6 (Jan 2019)
12.0.1 (Jan 2019) Cisco Finesse CSCvn22344 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22344"] Patch file available for 11.6 by Dec 2018
12.0.1 (Jan 2019) Cisco Hosted Collaboration Mediation Fulfillment CSCvn18961 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18961"] 11.5(4) (Available) Cisco Hosted Collaboration Solution for Contact Center CSCvn18962 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18962"] 12.0.1 (Jan 2019) Cisco MediaSense CSCvn22346 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22346"] No fix planned Cisco Unified Communications Manager IM & Presence Service (formerly CUPS) CSCvn18959 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18959"] Patch file available for 10.5.2/11.5.1/12.0.1 by Dec 2018
12.5.1 (Jan 2019) Cisco Unified Communications Manager CSCvn18952 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18952"] Patch file available for 10.5.2/11.5.1/12.0.1 by Dec 2018
12.5.1 (Jan 2019) Cisco Unified Contact Center Enterprise CSCvn18888 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18888"] 12.0.1 (Jan 2019) Cisco Unified Contact Center Express CSCvn18955 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18955"] Patch file available for 11.5/11.6 by Dec 2018
12.0.1 (Jan 2019) Cisco Unified E-Mail Interaction Manager CSCvn18958 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18958"] No fix planned Cisco Unified Intelligence Center CSCvn18887 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18887"] Patch file available for 11.5/11.6 by Dec 2018
12.0.1 (Jan 2019) Cisco Unified Intelligent Contact Management Enterprise CSCvn18888 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18888"] 12.0.1 (Jan 2019) Cisco Unified Web Interaction Manager CSCvn18958 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18958"] No fix planned Cisco Unity Connection CSCvn18954 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18954"] Patch file available for 10.5.2/11.5.1/12.0.1 by Dec 2018
12.5.1 (Jan 2019) Cisco Virtualized Voice Browser CSCvn18963 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18963"] Patch file available for 11.5/11.6 by Dec 2018
12.0.1 (Jan 2019) Video, Streaming, TelePresence, and Transcoding Devices Cisco Video Distribution Suite for Internet Streaming (VDS-IS) CSCvn18928 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18928"] Patch file available by Dec 2018 Wireless Cisco Mobility Services Engine CSCvn22305 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22305"] Patch file available by Dec 2018 Cisco Universal Small Cell RAN Management System (USC RMS) CSCvn18939 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18939"] No fix planned Cisco Cloud Hosted Services Cisco Prime Network Change and Configuration Management CSCvn19865 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn19865"] 3.6.1 (Dec 2018)
3.7 (Mar 2019) Cisco Smart Connected Spaces CSCvn22310 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22310"] Patch file available by Dec 2018 Cisco Smart Net Total Care - Contracts Information System Process Controller CSCvn18884 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18884"] 4.3.6 (Dec 2018) Cisco Webex Centers - Meeting Center, Training Center, Event Center, Support Center
CSCvn24113 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn24113"] T33.7.2 (Dec 2018)
T32.20.2 (Dec 2018) Cisco Webex Meetings CSCvn18908 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18908"] Cisco will update affected systems in Dec 2018
1 Cisco Secure Access Control System (ACS) has reached the End of Software Maintenance (EoSWM) milestone ["https://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/eos-eol-c51-738197.html"]. Only authenticated attackers with access to the Cisco ACS admin console could exploit this vulnerability. An administrator could also limit access to the Cisco ACS admin panel from trusted hosts in their environment.
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect the following products and services:
Network Application, Service, and Acceleration
Cisco Data Center Network Manager
Network and Content Security Devices
Cisco Firepower Management Center
Cisco Stealthwatch Endpoint Concentrator
Cisco Stealthwatch FlowCollector NetFlow
Cisco Stealthwatch FlowCollector sFlow
Cisco Stealthwatch FlowSensor
Cisco Stealthwatch Management Console (SMC)
Cisco Stealthwatch UDP Director
Network Management and Provisioning
Cisco Prime Access Registrar
Cisco Prime Central for Service Providers
Cisco Prime Collaboration Assurance
Cisco Prime Collaboration Deployment
Cisco Prime LAN Management Solution
Cisco Prime Provisioning
Cisco Security Manager
Routing and Switching - Enterprise and Service Provider
Cisco Broadband Access Center for Telco and Wireless
Unified Computing
Cisco HyperFlex System
Voice and Unified Communications Devices
Cisco Unified Customer Voice Portal
Cisco Unified SIP Proxy Software
Cisco Unified Survivable Remote Site Telephony Manager
Cisco Unity Express
Video, Streaming, TelePresence, and Transcoding Devices
Cisco StadiumVision Director
Cisco TelePresence Management Suite
Cisco Cloud Hosted Services
Cisco Business Video Services Automation Software
Cisco Cloud Web Security
Cisco Common Services Platform Collector
Cisco Network Device Security Assessment Service
Cisco Network Performance Analysis
Cisco Smart Net Total Care - On-Premises
Cisco Smart Net Total Care
Cisco Unified Service Delivery Platform
Cisco Webex Network-Based Recording (NBR) Management
Workarounds
Any workarounds for a specific Cisco product or service will be documented in product-specific or service-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.
Fixed Software
For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products ["#vp"] section of this advisory. Questions concerning the Webex environment may be directed to the Cisco Technical Assistance Center (TAC).
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page ["https://www.cisco.com/go/psirt"], to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco TAC or their contracted maintenance providers.
Vulnerability Policy
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
Exploitation and Public Announcements
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerability that is described in this advisory.
Source
On November 5th, 2018, the Apache Software Foundation released a security announcement at the following link: Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior ["https://www.mail-archive.com/announcements@struts.apache.org/msg00093.html"]
Legal Disclaimer
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.
{
"document": {
"acknowledgments": [
{
"summary": "On November 5th, 2018, the Apache Software Foundation released a security announcement at the following link: Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior [\"https://www.mail-archive.com/announcements@struts.apache.org/msg00093.html\"]"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"notes": [
{
"category": "summary",
"text": "On November 5, 2018, the Apache Struts Team released a security announcement urging an upgrade of the Commons FileUpload library to version 1.3.3 on systems using Struts 2.3.36 or earlier releases. Systems using earlier versions of this library may be exposed to attacks that could allow execution of arbitrary code or modifications of files on the system. The issue is caused by a previously reported vulnerability of the Apache Commons FileUpload library, assigned to CVE-2016-1000031.\r\n\r\nThe vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by submitting crafted data to an affected system. A successful exploit could allow the attacker to execute arbitrary code or manipulate files on the targeted system.\r\n\r\n",
"title": "Summary"
},
{
"category": "general",
"text": "Cisco investigated its product line to determine which products and services may be affected by this vulnerability.\r\n\r\nThe Vulnerable Products [\"#vp\"] section of this advisory includes Cisco bug IDs for each affected product or service. The bugs are accessible through the Cisco Bug Search Tool [\"https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID\"] and contain additional platform-specific information, including workarounds (if available) and fixed software releases.\r\n\r\nAny product or service not listed in the \u201cVulnerable Products\u201d section of this advisory is to be considered not vulnerable.",
"title": "Affected Products"
},
{
"category": "general",
"text": "The following table lists Cisco products and services that are affected by the vulnerability that is described in this advisory. The software availability dates in the Fixed Release Availability column are estimates, and actual software availability may differ from the dates provided in the following table.\r\n Product Cisco Bug ID Fixed Release Availability Collaboration and Social Media Cisco SocialMiner CSCvn22343 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22343\"] Patch file available for 11.5/11.6 by Dec 2018\r\n12.0.1 (Jan 2019) Cisco Webex Meetings Server CSCvn18895 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18895\"] 2.8MR3 Security Patch 1 (Dec 2018)\r\n3.0MR2 Security Patch 2 (Dec 2018) Endpoint Clients and Client Software Cisco Webex Management - SuperAdmin Control Panel CSCvn18901 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18901\"] T33.7.2 (Dec 2018) Network and Content Security Devices Cisco Identity Services Engine (ISE) CSCvn17524 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn17524\"] Hot patch available for 2.1 Patch 7/2.3 Patch 5\r\n2.2 Patch 12 (Nov 2018)\r\n2.3 Patch 6 (Feb 2019)\r\n2.4 Patch 5 (Nov 2018)\r\n2.5 (Dec 2018) Cisco Secure Access Control System (ACS) CSCvn18934 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18934\"] No fix planned 1 Network Management and Provisioning Cisco Evolved Programmable Network Manager CSCvn44132 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn44132\"] 2.2.1.2 (Dec 2018) Cisco Prime Collaboration Provisioning CSCvn18919 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18919\"] 12.6 (Nov 2018) Cisco Prime Infrastructure CSCvn18917 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18917\"] 3.3.1 Update 04 (Feb 2019)\r\n3.4.1 Update 03 (Mar 2019)\r\n3.5 (Dec 2018) Cisco Prime License Manager CSCvn18924 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18924\"] Patch file available for 10.5.2/11.5.1 by Dec 2018 Cisco Prime Network Registrar IP Address Manager (IPAM) CSCvn18913 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18913\"] No fix planned Cisco Prime Network CSCvn18910 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18910\"] Patch file available for 5.1 by Dec 2018\r\n5.2 (May 2019) Cisco Prime Service Catalog CSCvn22307 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22307\"] 12.1 v7 Patch (Dec 2018) Routing and Switching - Enterprise and Service Provider Cisco IOx Fog Director CSCvn19758 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn19758\"] 1.7.1 (Jan 2019)\r\n1.8 (Feb 2019) Cisco IoT Field Network Director (formerly Cisco Connected Grid Network Management System) CSCvn20600 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn20600\"] 4.3.2 (Dec 2018) Voice and Unified Communications Devices Cisco Emergency Responder CSCvn18956 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18956\"] Patch file available for 11.5.1/12.0.1 by Dec 2018\r\n12.5.1 (Jan 2019) Cisco Enterprise Chat and Email CSCvn18957 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18957\"] 11.6 ES6 (Jan 2019)\r\n12.0.1 (Jan 2019) Cisco Finesse CSCvn22344 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22344\"] Patch file available for 11.6 by Dec 2018\r\n12.0.1 (Jan 2019) Cisco Hosted Collaboration Mediation Fulfillment CSCvn18961 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18961\"] 11.5(4) (Available) Cisco Hosted Collaboration Solution for Contact Center CSCvn18962 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18962\"] 12.0.1 (Jan 2019) Cisco MediaSense CSCvn22346 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22346\"] No fix planned Cisco Unified Communications Manager IM \u0026 Presence Service (formerly CUPS) CSCvn18959 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18959\"] Patch file available for 10.5.2/11.5.1/12.0.1 by Dec 2018\r\n12.5.1 (Jan 2019) Cisco Unified Communications Manager CSCvn18952 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18952\"] Patch file available for 10.5.2/11.5.1/12.0.1 by Dec 2018\r\n12.5.1 (Jan 2019) Cisco Unified Contact Center Enterprise CSCvn18888 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18888\"] 12.0.1 (Jan 2019) Cisco Unified Contact Center Express CSCvn18955 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18955\"] Patch file available for 11.5/11.6 by Dec 2018\r\n12.0.1 (Jan 2019) Cisco Unified E-Mail Interaction Manager CSCvn18958 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18958\"] No fix planned Cisco Unified Intelligence Center CSCvn18887 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18887\"] Patch file available for 11.5/11.6 by Dec 2018\r\n12.0.1 (Jan 2019) Cisco Unified Intelligent Contact Management Enterprise CSCvn18888 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18888\"] 12.0.1 (Jan 2019) Cisco Unified Web Interaction Manager CSCvn18958 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18958\"] No fix planned Cisco Unity Connection CSCvn18954 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18954\"] Patch file available for 10.5.2/11.5.1/12.0.1 by Dec 2018\r\n12.5.1 (Jan 2019) Cisco Virtualized Voice Browser CSCvn18963 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18963\"] Patch file available for 11.5/11.6 by Dec 2018\r\n12.0.1 (Jan 2019) Video, Streaming, TelePresence, and Transcoding Devices Cisco Video Distribution Suite for Internet Streaming (VDS-IS) CSCvn18928 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18928\"] Patch file available by Dec 2018 Wireless Cisco Mobility Services Engine CSCvn22305 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22305\"] Patch file available by Dec 2018 Cisco Universal Small Cell RAN Management System (USC RMS) CSCvn18939 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18939\"] No fix planned Cisco Cloud Hosted Services Cisco Prime Network Change and Configuration Management CSCvn19865 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn19865\"] 3.6.1 (Dec 2018)\r\n3.7 (Mar 2019) Cisco Smart Connected Spaces CSCvn22310 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22310\"] Patch file available by Dec 2018 Cisco Smart Net Total Care - Contracts Information System Process Controller CSCvn18884 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18884\"] 4.3.6 (Dec 2018) Cisco Webex Centers - Meeting Center, Training Center, Event Center, Support Center\r\n CSCvn24113 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn24113\"] T33.7.2 (Dec 2018)\r\nT32.20.2 (Dec 2018) Cisco Webex Meetings CSCvn18908 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18908\"] Cisco will update affected systems in Dec 2018\r\n1 Cisco Secure Access Control System (ACS) has reached the End of Software Maintenance (EoSWM) milestone [\"https://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/eos-eol-c51-738197.html\"]. Only authenticated attackers with access to the Cisco ACS admin console could exploit this vulnerability. An administrator could also limit access to the Cisco ACS admin panel from trusted hosts in their environment.",
"title": "Vulnerable Products"
},
{
"category": "general",
"text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect the following products and services:\r\n Network Application, Service, and Acceleration\r\n\r\nCisco Data Center Network Manager\r\nNetwork and Content Security Devices\r\n\r\nCisco Firepower Management Center\r\nCisco Stealthwatch Endpoint Concentrator\r\nCisco Stealthwatch FlowCollector NetFlow\r\nCisco Stealthwatch FlowCollector sFlow\r\nCisco Stealthwatch FlowSensor\r\nCisco Stealthwatch Management Console (SMC)\r\nCisco Stealthwatch UDP Director\r\nNetwork Management and Provisioning\r\n\r\nCisco Prime Access Registrar\r\nCisco Prime Central for Service Providers\r\nCisco Prime Collaboration Assurance\r\nCisco Prime Collaboration Deployment\r\nCisco Prime LAN Management Solution\r\nCisco Prime Provisioning\r\nCisco Security Manager\r\nRouting and Switching - Enterprise and Service Provider\r\n\r\nCisco Broadband Access Center for Telco and Wireless\r\nUnified Computing\r\n\r\nCisco HyperFlex System\r\nVoice and Unified Communications Devices\r\n\r\nCisco Unified Customer Voice Portal\r\nCisco Unified SIP Proxy Software\r\nCisco Unified Survivable Remote Site Telephony Manager\r\nCisco Unity Express\r\nVideo, Streaming, TelePresence, and Transcoding Devices\r\n\r\nCisco StadiumVision Director\r\nCisco TelePresence Management Suite\r\nCisco Cloud Hosted Services\r\n\r\nCisco Business Video Services Automation Software\r\nCisco Cloud Web Security\r\nCisco Common Services Platform Collector\r\nCisco Network Device Security Assessment Service\r\nCisco Network Performance Analysis\r\nCisco Smart Net Total Care - On-Premises\r\nCisco Smart Net Total Care\r\nCisco Unified Service Delivery Platform\r\nCisco Webex Network-Based Recording (NBR) Management",
"title": "Products Confirmed Not Vulnerable"
},
{
"category": "general",
"text": "Any workarounds for a specific Cisco product or service will be documented in product-specific or service-specific Cisco bugs, which are identified in the Vulnerable Products [\"#vp\"] section of this advisory.",
"title": "Workarounds"
},
{
"category": "general",
"text": "For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products [\"#vp\"] section of this advisory. Questions concerning the Webex environment may be directed to the Cisco Technical Assistance Center (TAC).\r\n\r\nWhen considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco TAC or their contracted maintenance providers.",
"title": "Fixed Software"
},
{
"category": "general",
"text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
"title": "Vulnerability Policy"
},
{
"category": "general",
"text": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerability that is described in this advisory.",
"title": "Exploitation and Public Announcements"
},
{
"category": "general",
"text": "On November 5th, 2018, the Apache Software Foundation released a security announcement at the following link: Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior [\"https://www.mail-archive.com/announcements@struts.apache.org/msg00093.html\"]",
"title": "Source"
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
"title": "Legal Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@cisco.com",
"issuing_authority": "Cisco PSIRT",
"name": "Cisco",
"namespace": "https://wwww.cisco.com"
},
"references": [
{
"category": "self",
"summary": "Apache Struts Commons FileUpload Library Remote Code Execution Vulnerability Affecting Cisco Products: November 2018",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-struts-commons-fileupload"
},
{
"category": "external",
"summary": "Cisco Security Vulnerability Policy",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
},
{
"category": "external",
"summary": "Cisco Bug Search Tool",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"
},
{
"category": "external",
"summary": "CSCvn22343",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22343"
},
{
"category": "external",
"summary": "CSCvn18895",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18895"
},
{
"category": "external",
"summary": "CSCvn18901",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18901"
},
{
"category": "external",
"summary": "CSCvn17524",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn17524"
},
{
"category": "external",
"summary": "CSCvn18934",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18934"
},
{
"category": "external",
"summary": "CSCvn44132",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn44132"
},
{
"category": "external",
"summary": "CSCvn18919",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18919"
},
{
"category": "external",
"summary": "CSCvn18917",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18917"
},
{
"category": "external",
"summary": "CSCvn18924",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18924"
},
{
"category": "external",
"summary": "CSCvn18913",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18913"
},
{
"category": "external",
"summary": "CSCvn18910",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18910"
},
{
"category": "external",
"summary": "CSCvn22307",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22307"
},
{
"category": "external",
"summary": "CSCvn19758",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn19758"
},
{
"category": "external",
"summary": "CSCvn20600",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn20600"
},
{
"category": "external",
"summary": "CSCvn18956",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18956"
},
{
"category": "external",
"summary": "CSCvn18957",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18957"
},
{
"category": "external",
"summary": "CSCvn22344",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22344"
},
{
"category": "external",
"summary": "CSCvn18961",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18961"
},
{
"category": "external",
"summary": "CSCvn18962",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18962"
},
{
"category": "external",
"summary": "CSCvn22346",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22346"
},
{
"category": "external",
"summary": "CSCvn18959",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18959"
},
{
"category": "external",
"summary": "CSCvn18952",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18952"
},
{
"category": "external",
"summary": "CSCvn18888",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18888"
},
{
"category": "external",
"summary": "CSCvn18955",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18955"
},
{
"category": "external",
"summary": "CSCvn18958",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18958"
},
{
"category": "external",
"summary": "CSCvn18887",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18887"
},
{
"category": "external",
"summary": "CSCvn18954",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18954"
},
{
"category": "external",
"summary": "CSCvn18963",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18963"
},
{
"category": "external",
"summary": "CSCvn18928",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18928"
},
{
"category": "external",
"summary": "CSCvn22305",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22305"
},
{
"category": "external",
"summary": "CSCvn18939",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18939"
},
{
"category": "external",
"summary": "CSCvn19865",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn19865"
},
{
"category": "external",
"summary": "CSCvn22310",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn22310"
},
{
"category": "external",
"summary": "CSCvn18884",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18884"
},
{
"category": "external",
"summary": "CSCvn24113",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn24113"
},
{
"category": "external",
"summary": "CSCvn18908",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn18908"
},
{
"category": "external",
"summary": "End of Software Maintenance (EoSWM) milestone",
"url": "https://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/eos-eol-c51-738197.html"
},
{
"category": "external",
"summary": "Cisco Security Advisories and Alerts page",
"url": "https://www.cisco.com/go/psirt"
},
{
"category": "external",
"summary": "Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior",
"url": "https://www.mail-archive.com/announcements@struts.apache.org/msg00093.html"
}
],
"title": "Apache Struts Commons FileUpload Library Remote Code Execution Vulnerability Affecting Cisco Products: November 2018",
"tracking": {
"current_release_date": "2019-02-07T14:49:00+00:00",
"generator": {
"date": "2024-05-10T22:46:00+00:00",
"engine": {
"name": "TVCE"
}
},
"id": "cisco-sa-20181107-struts-commons-fileupload",
"initial_release_date": "2018-11-07T00:00:00+00:00",
"revision_history": [
{
"date": "2018-11-07T21:47:08+00:00",
"number": "1.0.0",
"summary": "Initial public release."
},
{
"date": "2018-11-08T21:05:37+00:00",
"number": "1.1.0",
"summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable."
},
{
"date": "2018-11-09T18:57:30+00:00",
"number": "1.2.0",
"summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
},
{
"date": "2018-11-12T20:29:14+00:00",
"number": "1.3.0",
"summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
},
{
"date": "2018-11-13T20:59:30+00:00",
"number": "1.4.0",
"summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability. Indicated that the Cisco TAC is a resource for the Webex environment."
},
{
"date": "2018-11-14T19:42:41+00:00",
"number": "1.5.0",
"summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
},
{
"date": "2018-11-15T18:26:20+00:00",
"number": "1.6.0",
"summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
},
{
"date": "2018-11-16T19:45:35+00:00",
"number": "1.7.0",
"summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable."
},
{
"date": "2018-11-19T18:53:44+00:00",
"number": "1.8.0",
"summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
},
{
"date": "2018-11-20T18:56:12+00:00",
"number": "1.9.0",
"summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
},
{
"date": "2018-11-21T19:35:12+00:00",
"number": "1.10.0",
"summary": "Updated the list of vulnerable products. Updated information about fixed release availability."
},
{
"date": "2018-11-22T17:43:09+00:00",
"number": "1.11.0",
"summary": "Updated information about Cisco Webex Centers exposure. Updated information about fixed release availability."
},
{
"date": "2018-11-26T17:38:47+00:00",
"number": "1.12.0",
"summary": "Updated information about fixed release availability."
},
{
"date": "2018-11-28T18:11:29+00:00",
"number": "1.13.0",
"summary": "Updated information about fixed release availability."
},
{
"date": "2018-11-30T18:27:04+00:00",
"number": "1.14.0",
"summary": "Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability."
},
{
"date": "2018-12-05T16:34:38+00:00",
"number": "1.15.0",
"summary": "Updated information about fixed release availability. Removed references to ongoing investigation."
},
{
"date": "2019-01-11T14:52:41+00:00",
"number": "1.16.0",
"summary": "Updated information about fixed release availability for Cisco Prime Infrastructure. The fix was not integrated in release 3.3.1 Update 03 but will be integrated in 3.3.1 Update 04."
},
{
"date": "2019-02-07T14:49:51+00:00",
"number": "1.17.0",
"summary": "Updated information about fixed release availability for Cisco Prime Infrastructure. The fix was not integrated in release 3.4.1 Update 02 but will be integrated in 3.4.1 Update 03. Corrected a typo referencing January 2018 instead of January 2019 as availability time for some fixed releases."
}
],
"status": "final",
"version": "1.17.0"
}
},
"vulnerabilities": [
{
"cve": "CVE-2016-1000031",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2018-11-05T12:32:00+00:00",
"title": "Apache Struts Commons FileUpload Library Remote Code Execution Vulnerability Affecting Cisco Products: November 2018"
}
]
}
opensuse-su-2019:1399-1
Vulnerability from csaf_opensuse
Published
2019-05-15 14:47
Modified
2019-05-15 14:47
Summary
Security update for jakarta-commons-fileupload
Notes
Title of the patch
Security update for jakarta-commons-fileupload
Description of the patch
This update for jakarta-commons-fileupload fixes the following issue:
Security issue fixed:
- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames
openSUSE-2019-1399
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for jakarta-commons-fileupload",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for jakarta-commons-fileupload fixes the following issue:\n\nSecurity issue fixed:\n\n- CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829).\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2019-1399",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1399-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2019:1399-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLTXNSZ2EZZYRNHUZYDN67SU2IBOUXXZ/#LLTXNSZ2EZZYRNHUZYDN67SU2IBOUXXZ"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2019:1399-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLTXNSZ2EZZYRNHUZYDN67SU2IBOUXXZ/#LLTXNSZ2EZZYRNHUZYDN67SU2IBOUXXZ"
},
{
"category": "self",
"summary": "SUSE Bug 1128829",
"url": "https://bugzilla.suse.com/1128829"
},
{
"category": "self",
"summary": "SUSE Bug 1128963",
"url": "https://bugzilla.suse.com/1128963"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1000031 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1000031/"
}
],
"title": "Security update for jakarta-commons-fileupload",
"tracking": {
"current_release_date": "2019-05-15T14:47:24Z",
"generator": {
"date": "2019-05-15T14:47:24Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2019:1399-1",
"initial_release_date": "2019-05-15T14:47:24Z",
"revision_history": [
{
"date": "2019-05-15T14:47:24Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "jakarta-commons-fileupload-1.1.1-lp150.2.3.1.noarch",
"product": {
"name": "jakarta-commons-fileupload-1.1.1-lp150.2.3.1.noarch",
"product_id": "jakarta-commons-fileupload-1.1.1-lp150.2.3.1.noarch"
}
},
{
"category": "product_version",
"name": "jakarta-commons-fileupload-javadoc-1.1.1-lp150.2.3.1.noarch",
"product": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-lp150.2.3.1.noarch",
"product_id": "jakarta-commons-fileupload-javadoc-1.1.1-lp150.2.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.0",
"product": {
"name": "openSUSE Leap 15.0",
"product_id": "openSUSE Leap 15.0",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-1.1.1-lp150.2.3.1.noarch as component of openSUSE Leap 15.0",
"product_id": "openSUSE Leap 15.0:jakarta-commons-fileupload-1.1.1-lp150.2.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-1.1.1-lp150.2.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jakarta-commons-fileupload-javadoc-1.1.1-lp150.2.3.1.noarch as component of openSUSE Leap 15.0",
"product_id": "openSUSE Leap 15.0:jakarta-commons-fileupload-javadoc-1.1.1-lp150.2.3.1.noarch"
},
"product_reference": "jakarta-commons-fileupload-javadoc-1.1.1-lp150.2.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-1000031",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1000031"
}
],
"notes": [
{
"category": "general",
"text": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.0:jakarta-commons-fileupload-1.1.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:jakarta-commons-fileupload-javadoc-1.1.1-lp150.2.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1000031",
"url": "https://www.suse.com/security/cve/CVE-2016-1000031"
},
{
"category": "external",
"summary": "SUSE Bug 1128963 for CVE-2016-1000031",
"url": "https://bugzilla.suse.com/1128963"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.0:jakarta-commons-fileupload-1.1.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:jakarta-commons-fileupload-javadoc-1.1.1-lp150.2.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.0:jakarta-commons-fileupload-1.1.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:jakarta-commons-fileupload-javadoc-1.1.1-lp150.2.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-05-15T14:47:24Z",
"details": "critical"
}
],
"title": "CVE-2016-1000031"
}
]
}
ghsa-7x9j-7223-rg5m
Vulnerability from github
Published
2018-12-21 17:51
Modified
2022-09-14 22:24
Severity ?
Summary
Improper Access Control in commons-fileupload
Details
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "commons-fileupload:commons-fileupload"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-1000031"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:23:40Z",
"nvd_published_at": "2016-10-25T14:29:00Z",
"severity": "CRITICAL"
},
"details": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution",
"id": "GHSA-7x9j-7223-rg5m",
"modified": "2022-09-14T22:24:42Z",
"published": "2018-12-21T17:51:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000031"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2016-30"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2016-23"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2016-12"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190212-0001"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/WW-4812"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/FILEUPLOAD-279"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-7x9j-7223-rg5m"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93604"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-16-570"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Access Control in commons-fileupload"
}
fkie_cve-2016-1000031
Vulnerability from fkie_nvd
Published
2016-10-25 14:29
Modified
2025-04-12 10:46
Severity ?
Summary
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| apache | commons_fileupload | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7A6FC4C5-ADA8-44B0-80B3-672B0025BF3C",
"versionEndIncluding": "1.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution"
},
{
"lang": "es",
"value": "Apache Commons FileUpload versi\u00f3n anterior a 1.3.3, la manipulaci\u00f3n del archivo DiskFileItem conduce a la ejecuci\u00f3n de c\u00f3digo remota."
}
],
"evaluatorComment": "Per Apache: \"Having reviewed your report we have concluded that it does not represent a valid vulnerability in Apache Commons File Upload. If an application deserializes data from an untrusted source without filtering and/or validation that is an application vulnerability not a vulnerability in the library a potential attacker might leverage.\"",
"id": "CVE-2016-1000031",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-10-25T14:29:00.180",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/93604"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-16-570/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://issues.apache.org/jira/browse/FILEUPLOAD-279"
},
{
"source": "cve@mitre.org",
"url": "https://issues.apache.org/jira/browse/WW-4812"
},
{
"source": "cve@mitre.org",
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E"
},
{
"source": "cve@mitre.org",
"url": "https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E"
},
{
"source": "cve@mitre.org",
"url": "https://security.netapp.com/advisory/ntap-20190212-0001/"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2016-12"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2016-23"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2016-30"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/93604"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-16-570/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://issues.apache.org/jira/browse/FILEUPLOAD-279"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://issues.apache.org/jira/browse/WW-4812"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.netapp.com/advisory/ntap-20190212-0001/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2016-12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2016-23"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2016-30"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
gsd-2016-1000031
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2016-1000031",
"description": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution",
"id": "GSD-2016-1000031",
"references": [
"https://www.suse.com/security/cve/CVE-2016-1000031.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2016-1000031"
],
"details": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution",
"id": "GSD-2016-1000031",
"modified": "2023-12-13T01:21:18.095156Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-1000031",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "93604",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/93604"
},
{
"name": "[announce] 20181105 [SECURITY] Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E"
},
{
"name": "[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E"
},
{
"name": "openSUSE-SU-2019:1399",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
"refsource": "CONFIRM",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"refsource": "MISC",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"refsource": "MISC",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"refsource": "MISC",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"name": "https://security.netapp.com/advisory/ntap-20190212-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20190212-0001/"
},
{
"name": "https://issues.apache.org/jira/browse/WW-4812",
"refsource": "CONFIRM",
"url": "https://issues.apache.org/jira/browse/WW-4812"
},
{
"name": "http://www.zerodayinitiative.com/advisories/ZDI-16-570/",
"refsource": "MISC",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-16-570/"
},
{
"name": "https://www.tenable.com/security/research/tra-2016-30",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2016-30"
},
{
"name": "https://www.tenable.com/security/research/tra-2016-12",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2016-12"
},
{
"name": "https://issues.apache.org/jira/browse/FILEUPLOAD-279",
"refsource": "CONFIRM",
"url": "https://issues.apache.org/jira/browse/FILEUPLOAD-279"
},
{
"name": "https://www.tenable.com/security/research/tra-2016-23",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2016-23"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "MISC",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2022.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "(,1.3.2]",
"affected_versions": "All versions up to 1.3.2",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-284",
"CWE-937"
],
"date": "2019-05-24",
"description": "There exists a Java Object in this package that can be manipulated in such a way that when it is deserialized, it can write or copy files to disk in arbitrary locations. Furthermore, while the Object can be used alone, this new vector can be integrated with ysoserial to upload and execute binaries in a single deserialization call. This may or may not work depending on an application\u0027s implementation of the FileUpload library.",
"fixed_versions": [
"1.3.3"
],
"identifier": "CVE-2016-1000031",
"identifiers": [
"CVE-2016-1000031"
],
"not_impacted": "All versions after 1.3.2",
"package_slug": "maven/commons-fileupload/commons-fileupload",
"pubdate": "2016-10-25",
"solution": "Upgrade to version 1.3.3 or above.",
"title": "Remote Code Execution",
"urls": [
"https://issues.apache.org/jira/browse/FILEUPLOAD-279",
"https://nvd.nist.gov/vuln/detail/CVE-2016-1000031",
"https://www.tenable.com/security/research/tra-2016-12"
],
"uuid": "b7ddbca2-ecba-47ac-bbb5-bbee68dca4fc"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.3.2",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-1000031"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "93604",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/93604"
},
{
"name": "https://www.tenable.com/security/research/tra-2016-30",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2016-30"
},
{
"name": "http://www.zerodayinitiative.com/advisories/ZDI-16-570/",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-16-570/"
},
{
"name": "https://issues.apache.org/jira/browse/FILEUPLOAD-279",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "https://issues.apache.org/jira/browse/FILEUPLOAD-279"
},
{
"name": "https://www.tenable.com/security/research/tra-2016-23",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2016-23"
},
{
"name": "https://www.tenable.com/security/research/tra-2016-12",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/research/tra-2016-12"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"name": "[announce] 20181105 [SECURITY] Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E"
},
{
"name": "https://issues.apache.org/jira/browse/WW-4812",
"refsource": "CONFIRM",
"tags": [],
"url": "https://issues.apache.org/jira/browse/WW-4812"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
"refsource": "CONFIRM",
"tags": [],
"url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"name": "https://security.netapp.com/advisory/ntap-20190212-0001/",
"refsource": "CONFIRM",
"tags": [],
"url": "https://security.netapp.com/advisory/ntap-20190212-0001/"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"name": "openSUSE-SU-2019:1399",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
},
{
"name": "[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2020.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"name": "N/A",
"refsource": "N/A",
"tags": [],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2020.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2021.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"name": "N/A",
"refsource": "N/A",
"tags": [],
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": true,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
},
"lastModifiedDate": "2022-07-25T18:15Z",
"publishedDate": "2016-10-25T14:29Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.