CVE-2018-16956

{"id": "CVE-2018-16956", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2018-09-18T02:29:00.840", "references": [{"url": "http://www.securityfocus.com/bid/105350", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://seclists.org/fulldisclosure/2018/Sep/22", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename requests. Pages can be renamed to include characters unsupported for URIs by the web server hosting the WCI Portal software (such as IIS). Renaming pages to include unsupported characters, such as 0x7f, prevents these pages from being accessed over the web server, causing a Denial of Service (DoS) to the page. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support."}, {"lang": "es", "value": "El componente AjaxControl de Oracle WebCenter Interaction Portal 10.3.3 no valida los nombres de las p\u00e1ginas al procesar las peticiones de renombramiento de p\u00e1gina. Las p\u00e1ginas pueden renombrarse para incluir caracteres que no est\u00e1n soportados para URI por el servidor web que aloja el software WCI Portal (como IIS). Al renombrar las p\u00e1ginas para que incluyan caracteres no soportados, como 0x7f, evita que se pueda acceder a ellas a trav\u00e9s del servidor web, provocando una denegaci\u00f3n de servicio (DoS) en la p\u00e1gina. NOTA: este CVE ha sido asignado por MITRE y no est\u00e1 validado por Oracle debido a que Oracle WebCenter Interaction Portal ya no tiene soporte."}], "lastModified": "2018-12-06T15:18:59.873", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:webcenter_interaction:10.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09AF34F7-194B-4114-AE1D-3CE10946B074"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}