CVE-2019-2478
published 2019-01-16CVE-2019-2478: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are…
PriorityP429medium5.3CVSS 3.0
AVNACLPRNUINSUCNINAL
EPSS
1.88%
77.0th percentile
Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | outside_in_technology | — | — |
| oracle | outside_in_technology | — | — |
| oracle_corporation | outside_in_technology | — | — |
| oracle_corporation | outside_in_technology | — | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-10392 jenkins-git-client-plugin: OS command injection via 'git ls-remote'
bugzilla·2020-04-01·CVSS 8.8
CVE-2019-10392 [HIGH] CVE-2019-10392 jenkins-git-client-plugin: OS command injection via 'git ls-remote'
CVE-2019-10392 jenkins-git-client-plugin: OS command injection via 'git ls-remote'
Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
Reference:
http://www.openwall.com/lists/oss-security/2019/09/12/2
Discussion:
External References:
https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1534
---
Fixed in OpenShift Container Platform 4 in the below advisories:
https://access.redhat.com/errata/RHBA-2020:0527
https://access.redhat.com/errata/RHBA-2020:0522
https://access.redhat.com/errata/RHBA-2020:0690
---
This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 3.11
Via RHSA-2020:2478 https://access.redhat.
Bugzilla
CVE-2019-16538 jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed scripts
bugzilla·2020-04-01·CVSS 8.8
CVE-2019-16538 [HIGH] CVE-2019-16538 jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed scripts
CVE-2019-16538 jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed scripts
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.
Reference:
http://www.openwall.com/lists/oss-security/2019/11/21/1
Discussion:
Created jenkins-script-security-plugin tracking bugs for this issue:
Affects: fedora-30 [bug 1819654]
---
External References:
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658
---
This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 3.11
Via RHSA-2020:2478 https://access.redhat.com/errata/RHSA-2020:2478
---
2019-01-16
Published