SB2020041458 - Multiple vulnerabilities in Oracle FLEXCUBE Private Banking

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020041458

SB2020041458 - Multiple vulnerabilities in Oracle FLEXCUBE Private Banking

Published: April 14, 2020

Security Bulletin ID SB2020041458
Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 50% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2019-10247)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Integrator Acquistion System (Eclipse Jetty) component in Oracle Endeca Information Discovery Integrator. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


2) Infinite loop (CVE-ID: CVE-2017-12626)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to infinite loops while parsing specially crafted WMF, EMF, MSG and macros and out of Memory exceptions while parsing specially crafted DOC, PPT and XLS. A remote attacker can cause the service to crash.

3) Improper input validation (CVE-ID: CVE-2019-0227)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Core (Apache Axis) component in Oracle Communications Design Studio. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


4) Improper input validation (CVE-ID: CVE-2019-10088)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Core (Apache Tika) component in Primavera Unifier. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


5) Improper input validation (CVE-ID: CVE-2019-2904)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Load Testing for Web Apps (Application Development Framework) component in Oracle Application Testing Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


6) Improper Authentication (CVE-ID: CVE-2019-12419)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due the access token services does not validate that the authenticated principal is equal to that of the supplied "clientId" parameter in the request. A remote authenticated attacker can steal an authorization code issued to another client and obtain an access token for the other client.


Remediation

Install update from vendor's website.

References