SB2018011809 - Multiple vulnerabilities in Oracle Fusion Middleware
Published: January 18, 2018
Security Bulletin ID
SB2018011809
Severity
Medium
Patch available
YES
Number of vulnerabilities
8
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Security restrictions bypass (CVE-ID: CVE-2017-10068)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to a flaw in the Oracle Business Intelligence Enterprise Edition Analytics Web Dashboards component. A remote attacker can access and partially modify data.
2) Security restrictions bypass (CVE-ID: CVE-2017-10273)
The vulnerability allows a local attacker to bypass security restrictions on the target system.The weakness exists due to a flaw in the Oracle JDeveloper Deployment component. A local attacker can partially access data, partially modify data, and partially deny service.
3) Security restrictions bypass (CVE-ID: CVE-2018-2564)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to a flaw in the Oracle WebCenter Content Content Server component. A remote attacker can partially access and modify data.
4) Information disclosure (CVE-ID: CVE-2018-2584)
The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.The weakness exists due to a flaw in the Oracle WebCenter Sites Advanced UI component. A remote attacker can partially access data.
5) Security restrictions bypass (CVE-ID: CVE-2018-2596)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to a flaw in the Oracle WebCenter Content Content Server component. A remote attacker can partially access and modify data.
6) Security restrictions bypass (CVE-ID: CVE-2018-2711)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to a flaw in the Oracle JDeveloper Security Framework component. A remote attacker can access and partially modify data.
7) Security restrictions bypass (CVE-ID: CVE-2018-2713)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to a flaw in the Oracle WebCenter Portal WebCenter Spaces Application component. A remote attacker can partially access and modify data.
8) Information disclosure (CVE-ID: CVE-2018-2715)
The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.The weakness exists due to a flaw in the Oracle Business Intelligence Enterprise Edition BI Platform Security component. A remote attacker can access important data.
Remediation
Install update from vendor's website.