cnvd - cnvd-2018-24131

cnvd-2018-24131

Vulnerability from cnvd

Title: Oracle Outside In Technology存在未明漏洞（CNVD-2018-24131）

Description:

Oracle Fusion Middleware是企业和云计算的数字业务平台，是一个全面的中间件产品系列，使企业能创建和运行敏捷、智能的业务应用程序，及通过充分利用现代硬件和软件架构来最大限度地提高IT效率。Oracle Outside In Technology是一套软件开发工具包 (SDK)，它为开发人员提供了一个提取、规范化、清理、转换和查看600多种非结构化文件格式的内容的综合解决方案。

Oracle Fusion Middleware中的Oracle Outside In Technology 8.5.3中的Outside In Filters组件存在未明漏洞。攻击者可利用该漏洞影响机密性、可用性。

Severity: 中

Patch Name: Oracle Outside In Technology存在未明漏洞（CNVD-2018-24131）的补丁

Patch Description:

Oracle Fusion Middleware中的Oracle Outside In Technology 8.5.3中的Outside In Filters组件存在未明漏洞。攻击者可利用该漏洞影响机密性、可用性。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布漏洞修复程序，请及时关注更新： https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Reference: https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html https://www.securityfocus.com/bid/105603

Impacted products

Name
Oracle Outside In Technology 8.5.3

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "105603"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-3220"
    }
  },
  "description": "Oracle Fusion Middleware\u662f\u4f01\u4e1a\u548c\u4e91\u8ba1\u7b97\u7684\u6570\u5b57\u4e1a\u52a1\u5e73\u53f0\uff0c\u662f\u4e00\u4e2a\u5168\u9762\u7684\u4e2d\u95f4\u4ef6\u4ea7\u54c1\u7cfb\u5217\uff0c\u4f7f\u4f01\u4e1a\u80fd\u521b\u5efa\u548c\u8fd0\u884c\u654f\u6377\u3001\u667a\u80fd\u7684\u4e1a\u52a1\u5e94\u7528\u7a0b\u5e8f\uff0c\u53ca\u901a\u8fc7\u5145\u5206\u5229\u7528\u73b0\u4ee3\u786c\u4ef6\u548c\u8f6f\u4ef6\u67b6\u6784\u6765\u6700\u5927\u9650\u5ea6\u5730\u63d0\u9ad8IT\u6548\u7387\u3002Oracle Outside In Technology\u662f\u4e00\u5957\u8f6f\u4ef6\u5f00\u53d1\u5de5\u5177\u5305 (SDK)\uff0c\u5b83\u4e3a\u5f00\u53d1\u4eba\u5458\u63d0\u4f9b\u4e86\u4e00\u4e2a\u63d0\u53d6\u3001\u89c4\u8303\u5316\u3001\u6e05\u7406\u3001\u8f6c\u6362\u548c\u67e5\u770b600\u591a\u79cd\u975e\u7ed3\u6784\u5316\u6587\u4ef6\u683c\u5f0f\u7684\u5185\u5bb9\u7684\u7efc\u5408\u89e3\u51b3\u65b9\u6848\u3002\n\nOracle Fusion Middleware\u4e2d\u7684Oracle Outside In Technology 8.5.3\u4e2d\u7684Outside In Filters\u7ec4\u4ef6\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5f71\u54cd\u673a\u5bc6\u6027\u3001\u53ef\u7528\u6027\u3002",
  "discovererName": "Behzad Najjarpour Jabbari, Secunia Research at Flexera Software, and Kamlapati Choubey of Trend Micro\u0027s Zero Day Initiative",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-24131",
  "openTime": "2018-11-26",
  "patchDescription": "Oracle Fusion Middleware\u662f\u4f01\u4e1a\u548c\u4e91\u8ba1\u7b97\u7684\u6570\u5b57\u4e1a\u52a1\u5e73\u53f0\uff0c\u662f\u4e00\u4e2a\u5168\u9762\u7684\u4e2d\u95f4\u4ef6\u4ea7\u54c1\u7cfb\u5217\uff0c\u4f7f\u4f01\u4e1a\u80fd\u521b\u5efa\u548c\u8fd0\u884c\u654f\u6377\u3001\u667a\u80fd\u7684\u4e1a\u52a1\u5e94\u7528\u7a0b\u5e8f\uff0c\u53ca\u901a\u8fc7\u5145\u5206\u5229\u7528\u73b0\u4ee3\u786c\u4ef6\u548c\u8f6f\u4ef6\u67b6\u6784\u6765\u6700\u5927\u9650\u5ea6\u5730\u63d0\u9ad8IT\u6548\u7387\u3002Oracle Outside In Technology\u662f\u4e00\u5957\u8f6f\u4ef6\u5f00\u53d1\u5de5\u5177\u5305 (SDK)\uff0c\u5b83\u4e3a\u5f00\u53d1\u4eba\u5458\u63d0\u4f9b\u4e86\u4e00\u4e2a\u63d0\u53d6\u3001\u89c4\u8303\u5316\u3001\u6e05\u7406\u3001\u8f6c\u6362\u548c\u67e5\u770b600\u591a\u79cd\u975e\u7ed3\u6784\u5316\u6587\u4ef6\u683c\u5f0f\u7684\u5185\u5bb9\u7684\u7efc\u5408\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nOracle Fusion Middleware\u4e2d\u7684Oracle Outside In Technology 8.5.3\u4e2d\u7684Outside In Filters\u7ec4\u4ef6\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5f71\u54cd\u673a\u5bc6\u6027\u3001\u53ef\u7528\u6027\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Oracle Outside In Technology\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2018-24131\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Oracle Outside In Technology 8.5.3"
  },
  "referenceLink": "https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html\r\nhttps://www.securityfocus.com/bid/105603",
  "serverity": "\u4e2d",
  "submitTime": "2018-10-17",
  "title": "Oracle Outside In Technology\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2018-24131\uff09"
}

CVE-2018-3220 (GCVE-0-2018-3220)

Vulnerability from cvelistv5

Published

2018-10-17 01:00

Modified

2024-10-02 19:34

Severity ?

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology.

Summary

Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).

References

▼	URL	Tags
	http://www.securityfocus.com/bid/105603	vdb-entry, x_refsource_BID
	http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Oracle Corporation	Outside In Technology	Version: 8.5.3 Version: 8.5.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:43:35.046Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105603",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105603"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-3220",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-02T18:06:27.828778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-02T19:34:53.126Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Outside In Technology",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.5.3"
            },
            {
              "status": "affected",
              "version": "8.5.4"
            }
          ]
        }
      ],
      "datePublic": "2018-10-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-21T13:57:01",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "105603",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105603"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2018-3220",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Outside In Technology",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "8.5.3"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.5.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105603",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105603"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2018-3220",
    "datePublished": "2018-10-17T01:00:00",
    "dateReserved": "2017-12-15T00:00:00",
    "dateUpdated": "2024-10-02T19:34:53.126Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted