Oracle WebCenter Sites component of Oracle Fusion Middleware is vulnerable to multiple vulnerabilities.

  - A remote code execution in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent:
    Install (Apache Common Collections)). An unauthenticated, remote attacker can exploit this, via a crafted     serialized Java object, to bypass authentication and execute arbitrary commands. (CVE-2015-7501)

  - An unspecified vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware     (subcomponent: Server). An unauthenticated, remote attacker can exploit this, via HTTP, to obtain access     to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized     update, insert or delete access to some of Oracle WebCenter Sites accessible data and unauthorized ability     to cause a partial denial of service (partial DOS) of Oracle WebCenter Sites. (CVE-2017-3542)

  - A remote code execution in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent:
    Third Party Tools (Struts 2)) due to incorrect exception handling and error-message generation during     file-upload attempts. An unauthenticated, remote attacker can exploit this, via a crafted Content-Type,     Content-Disposition, or Content-Length HTTP header, to bypass authentication and execute arbitrary     commands. (CVE-2017-5638)

In addition, Oracle WebCenter Sites is also affected by several additional vulnerabilities including code execution, denial of service, information disclosure, and other unspecified vulnerabilities. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle WebCenter Sites Multiple Vulnerabilities (April 2017 CPU)

critical Nessus Plugin ID 136998

Version 1.10