CVE-2020-9315
** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 81.8%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 81.81% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- oracle/iplanet web server
- Source
- cve@mitre.org
References
- http://seclists.org/fulldisclosure/2020/May/31Mailing List, Third Party Advisory
- https://www.oracle.com/support/lifetime-support/Vendor Advisory
- https://www.oracle.com/us/assets/lifetime-support-middleware-069163.pdfVendor Advisory
- https://wwws.nightwatchcybersecurity.com/2020/05/10/two-vulnerabilities-in-oracles-iplanet-web-server-cve-2020-9315-and-cve-2020-9314/Third Party Advisory
- http://seclists.org/fulldisclosure/2020/May/31Mailing List, Third Party Advisory
- https://www.oracle.com/support/lifetime-support/Vendor Advisory
- https://www.oracle.com/us/assets/lifetime-support-middleware-069163.pdfVendor Advisory
- https://wwws.nightwatchcybersecurity.com/2020/05/10/two-vulnerabilities-in-oracles-iplanet-web-server-cve-2020-9315-and-cve-2020-9314/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.