VulnerabilityModified

CVE-2002-1639

Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to obtain sensitive information via a request to the oracle.apps.cz.servlet.UiServlet servlet with the test parameter set to "version" or "host".

HIGH 7.5EPSS 5.33%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 5.33% probability · 92th percentile
CISA KEV: Not listed
Affected: oracle/configurator
Source: cve@mitre.org

References

http://securitytracker.com/id?1003967Patch, Third Party Advisory, VDB Entry
http://www.kb.cert.org/vuls/id/158323Patch, Third Party Advisory, US Government Resource
http://www.oracle.com/technology//deploy/security/htdocs/oconfigvul.htmlPatch
http://www.securityfocus.com/bid/4433Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/8782VDB Entry
http://securitytracker.com/id?1003967Patch, Third Party Advisory, VDB Entry
http://www.kb.cert.org/vuls/id/158323Patch, Third Party Advisory, US Government Resource
http://www.oracle.com/technology//deploy/security/htdocs/oconfigvul.htmlPatch
http://www.securityfocus.com/bid/4433Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/8782VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.