SB2019011540 - Multiple vulnerabilities in Oracle Retail Xstore Payment

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019011540

SB2019011540 - Multiple vulnerabilities in Oracle Retail Xstore Payment

Published: January 15, 2019

Security Bulletin ID SB2019011540
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2018-3311)

The vulnerability allows a remote non-authenticated attacker to read, manipulate or delete data.

The vulnerability exists due to improper input validation within the Security component in Oracle Retail Xstore Payment. A remote non-authenticated attacker can exploit this vulnerability to read, manipulate or delete data.


2) HTTP request smuggling attack (CVE-ID: CVE-2017-7658)

The disclosed vulnerability allows a remote attacker to conduct an HTTP request smuggling attack on the target system.

The vulnerability exists due to improper handling HTTP requests that contain more than one content-length header. A remote attacker can send a specially crafted HTTP request that contains a transfer-encoding header and a content-length header, cause the software and an upstream HTTP agent to misinterpret the boundary of the request and to poison the web cache on the system, which could be used to conduct further attacks.


Remediation

Install update from vendor's website.

References