SB2022042539 - Multiple vulnerabilities in Oracle Solaris Cluster

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022042539

SB2022042539 - Multiple vulnerabilities in Oracle Solaris Cluster

Published: April 25, 2022

Security Bulletin ID SB2022042539
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Path traversal (CVE-ID: CVE-2021-29425)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error within the FileNameUtils.normalize method when processing directory traversal sequences, such as "//../foo", or "\..foo". A remote attacker can send a specially crafted request and verify files availability in the parent folder.


2) Improper input validation (CVE-ID: CVE-2020-6950)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Web Container (JavaServer Faces) component in Oracle WebLogic Server. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


3) Input validation error (CVE-ID: CVE-2019-17195)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to Nimbus JOSE+JWT throws various uncaught exceptions while parsing a JWT. A remote attacker can send a specially crafted JWT token and cause the application to crash or potentially bypass authentication.


Remediation

Install update from vendor's website.

References