SB2021012081 - Multiple vulnerabilities in Oracle Retail Store Inventory Management

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021012081

SB2021012081 - Multiple vulnerabilities in Oracle Retail Store Inventory Management

Published: January 20, 2021

Security Bulletin ID SB2021012081
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2019-17091)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Maps (Mojarra) component in Oracle Communications Unified Inventory Management. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-11979)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect patch for vulnerability #VU27924 (CVE-2020-1945). Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.


Remediation

Install update from vendor's website.

References