CVE-2018-16957

{"id": "CVE-2018-16957", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-09-18T02:29:00.950", "references": [{"url": "http://www.securityfocus.com/bid/105350", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://seclists.org/fulldisclosure/2018/Sep/22", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The Oracle WebCenter Interaction 10.3.3 search service queryd.exe binary is compiled with the i1g2s3c4 hardcoded password. Authentication to the Oracle WCI search service uses this hardcoded password and cannot be customised by customers. An adversary able to access this service over a network could perform search queries to extract large quantities of sensitive information from the WCI installation. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support."}, {"lang": "es", "value": "El binario del servicio de b\u00fasqueda queryd.exe de Oracle WebCenter Interaction 10.3.3 se compila con la contrase\u00f1a embebida i1g2s3c4. La autenticaci\u00f3n al servicio de b\u00fasqueda de Oracle WCI emplea esta contrase\u00f1a embebida y no puede ser personalizable por los clientes. Un adversario que pueda acceder a este servicio a trav\u00e9s de la red podr\u00eda realizar consultas de b\u00fasqueda para extraer grandes cantidades de informaci\u00f3n sensible desde la instalaci\u00f3n de WCI. NOTA: este CVE ha sido asignado por MITRE y no est\u00e1 validado por Oracle debido a que Oracle WebCenter Interaction Portal ya no tiene soporte."}], "lastModified": "2018-12-06T15:04:12.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:webcenter_interaction:10.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09AF34F7-194B-4114-AE1D-3CE10946B074"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}