CVE-2013-3770

Description

Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1, 11.1.1.6.0, and 11.1.1.7.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Content Server. NOTE: the previous information is from the October 2013 CPU. Oracle has not commented on claims from a third party that the issue is related to "iDoc script injection" in the (1) cs and (2) urm components, which allows attackers to read "sensitive" files, as demonstrated by obtaining the "AES encryption key and encrypted credentials" of the weblogic user.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/85658

http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=1038

http://www.securitytracker.com/id/1028801

http://www.securityfocus.com/bid/61228

http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html

http://secunia.com/advisories/54227

http://osvdb.org/95271

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3