CVE-2018-16954

CWE-601 — Open Redirect3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.2%
top 63.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Oracle Webcenter Interaction
Timeline
PublishedSep 18
Latest updateMay 14

Description

An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The login function of the portal is vulnerable to insecure redirection (also called an open redirect). The in_hi_redirect parameter is not validated by the application after a successful login. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

Patches

Patch: seclists.org ↗Patch: seclists.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-g8wr-5fx9-g2gv: An issue was discovered in Oracle WebCenter Interaction Portal 10↗2022-05-14
▶
CVEList
CVE-2018-16954: An issue was discovered in Oracle WebCenter Interaction Portal 10↗2018-09-18
▶