Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control

highseverity

8.6CVSS score

71.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data.

Impact

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information or perform unauthorized actions.

Fix

Apply the necessary patches or updates provided by Oracle to fix the Broken Access Control vulnerability (CVE-2019-2578).

How to confirm it

Send: GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/WebReferences ; GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/Slots
Positive when: matches /<script[\d\D]*<throwexception/>/

Run it with nuclei: nuclei -id CVE-2019-2578 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-2578

info:
  name: Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control
  author: leovalcante
  severity: high
  description: Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information or perform unauthorized actions.
  remediation: |
    Apply the necessary patches or updates provided by Oracle to fix the Broken Access Control vulnerability (CVE-2019-2578).
  reference:
    - https://www.oracle.com/security-alerts/cpuapr2019.html
    - https://outpost24.com/blog/Vulnerabilities-discovered-in-Oracle-WebCenter-Sites
    - https://nvd.nist.gov/vuln/detail/CVE-2019-2578
    - http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2019-2578
    epss-score: 0.71184
    epss-percentile: 0.99413
    cpe: cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: oracle
    product: webcenter_sites
  tags: cve,cve2019,oracle,wcs,auth-bypass,vuln

http:
  - raw:
      - |
        GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/WebReferences HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/Slots HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    matchers:
      - type: regex
        part: body
        regex:
          - '<script[\d\D]*<throwexception/>'

References

Use this check only on systems you are authorised to test. Where the data comes from