CVE-2018-2791

published 2018-04-19

CVE-2018-2791: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are…

Priority P2 66 high 8.2 CVSS 3.0

AV N AC L PR N UI R S C C H I L A N

EXPLOIT

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
oracle	webcenter_sites	—	—
oracle	webcenter_sites	—	—
oracle	webcenter_sites	—	—
oracle_corporation	webcenter_sites	—	—
oracle_corporation	webcenter_sites	—	—
oracle_corporation	webcenter_sites	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /cs/Satellite?pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=qqq%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E↗

url /cs/Satellite?destpage="alert(document.domain)&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError↗

url servlet/Satellite?c=Noticia&cid={ID}&pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=eee%22%3E%3Cscript%3Ealert(123)%3C/script%3E%3C↗

url servlet/Satellite?destpage="<h1xxx<scriptalert(1)</script&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError↗

path /cs/Satellite↗

• → Detect XSS exploitation attempt via cs_imagedir parameter: look for response body containing injected script path pattern ↗
• → Detect XSS exploitation attempt via destpage parameter: look for response body containing 'alert(24)' or 'Missing translation key' ↗
• → Google dork for identifying exposed Oracle WebCenter Sites instances: inurl:Satellite?c ↗
• → Two distinct vulnerable endpoints exist: the confirmmakeasset endpoint (cs_imagedir parameter) and the LoginError endpoint (destpage parameter); monitor HTTP requests to both paths for XSS payloads ↗

• · The confirmmakeasset payload requires a valid content ID (cid) for the target site; the PoC uses a sample ID (1362484193835) which must be replaced with a real asset ID on the target instance ↗
• · The Nuclei template uses stop-at-first-match and OR matcher logic across two requests; both request paths should be tested independently as different parameters are vulnerable ↗

CVSS provenance

nvd v3.0 8.2 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

nvd v2.0 5.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.