Description

XMLPService service of Oracle Business Intelligence has the authentication bypass vulnerability. Therefore, an attacker can interact with the server as an administrator and install additional plugins, which may lead to takeover of the server.

Remediation

Upgrade to the latest version of Oracle Business Intelligence. This issue was fixed in Oracle Critical Patch Update - July 2019

References

Oracle Critical Patch Update Advisory - July 2019

Related Vulnerabilities

phpMyAdmin Improper Input Validation Vulnerability (CVE-2013-5029)

MediaWiki Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2022-34750)

Oracle JRE CVE-2013-2447 Vulnerability (CVE-2013-2447)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-1587)

Werkzeug WSGI URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2020-28724)

Severity

High

Classification

CVE-2019-2768 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Authentication Bypass Known Vulnerabilities