Detections
Analytics

Oracle WebLogic UDDI Explorer Server-Side Request Forgery

medium Web App Scanning Plugin ID 112422

Language:

Synopsis

Oracle WebLogic UDDI Explorer Server-Side Request Forgery

Description

The Oracle WebLogic UDDI Explorer service in Oracle Fusion Middleware versions 10.0.2 and 10.3.6 is affected by a server-side request forgery vulnerability due to the lack of validation of the operator parameter in the SearchPublicRegistries.jsp page. A remote and unauthenticated attacker can exploit this issue to retrieve sensitive information and conduct port scanning on the target application and its internal network.

Solution

Apply the Oracle Critical Patch Update from July 2014. As an immediate workaround, restrict or disable Oracle WebLogic UDDI Explorer.

See Also

https://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html

https://support.oracle.com/knowledge/Middleware/1274906_1.html

https://www.oracle.com/security-alerts/cpujul2014.html

Plugin Details

Severity: Medium

ID: 112422

Type: remote

Published: 5/28/2020

Updated: 9/7/2021

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 2.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2014-4210

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS Score Source: CVE-2014-4210

Vulnerability Information

CPE: cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Reference Information

CVE: CVE-2014-4210

BID: 68629