SB20241015132 - Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20241015132

SB20241015132 - Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite

Published: October 15, 2024 Updated: November 15, 2024

Security Bulletin ID SB20241015132
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 67% Medium 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Inefficient Algorithmic Complexity (CVE-ID: CVE-2023-46136)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to high resource usage when parsing multipart/form-data. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-40898)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in Apache HTTP Server on Windows with mod_rewrite in server/vhost context. A remote attacker can force the web server to leak NTML hashes to a malicious server via SSRF and malicious requests.


3) Improper access control (CVE-ID: CVE-2024-43044)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the "ClassLoaderProxy#fetchJar" method in the Remoting library. A remote attacker can read arbitrary files on the Jenkins controller file system, leading to arbitrary code execution.


Remediation

Install update from vendor's website.

References