Oracle WebCenter Sites component of Oracle Fusion Middleware is vulnerable to multiple vulnerabilities :

  - A deserialization vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion Middleware     (subcomponent: Advanced UI (Apache Groovy)) due to a lack of isolation of object deserialization code. An     unauthenticated, remote attacker can exploit this, via HTTP, to execute arbitrary code on the target host.
    (CVE-2016-6814)

  - A remote code execution vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Advanced UI (Apache Commons FileUpload)) due to an unspecified reason. An     unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands.
    (CVE-2016-1000031)

  - A denial of service (DoS) vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Third Party Tools (Apache Batik)) due to an issue with deserialization. An     unauthenticated, remote attacker can exploit this issue, via HTTP, to cause the application to stop     functioning properly. (CVE-2018-8013)

  - A denial of service (DoS) vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Advanced UI (Spring Framework)) due to an issue handling range requests with     a high number of ranges, wide ranges that overlap, or both. An unauthenticated, remote attacker can     exploit this issue, via HTTP, to cause the application to stop responding. (CVE-2018-15765)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle WebCenter Sites Multiple Vulnerabilities (July 2019 CPU)

critical Nessus Plugin ID 136091

Version 1.7

Version 1.6

Version 1.7 Mar 14, 2024, 3:54 PM CVSSv2 score source (changed from "CVE-2016-1000031" to "CVE-2018-8013") Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202403141554
Version 1.6 Dec 6, 2022, 1:01 AM Reference Plugin Feed: 202212060101