Oracle Business Intelligence Adfresource Path traversal CVE-2019-2588

Description

Adfresource servlet of Oracle Business Intelligence has a path traversal vulnerability. An attacker can craft a request that accesses potentially sensitive information on the server, which may lead to takeover of the server.

Remediation

Upgrade to the latest version of Oracle Business Intelligence. This issue was fixed in Oracle Critical Patch Update - April 2019

References

Oracle Critical Patch Update Advisory - April 2019

Related Vulnerabilities

Cisco Adaptive Security Appliance (ASA) Path Traversal (CVE-2018-0296)

Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-12167)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-6831)

Artifactory Insufficiently Protected Credentials Vulnerability (CVE-2018-1000424)

Internet Information Services Other Vulnerability (CVE-2002-0075)

Severity

High

Classification

CVE-2019-2588 CWE-200 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N