Vulnerability CVE-2010-4437 - CERT Civis.Net

Vulnerability Name:

CVE-2010-4437 (CCN-64764)

Assigned:

2010-12-06

Published:

2011-01-19

Updated:

2017-08-17

Summary:

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 9.0, 9.1, 9.2.4, 10.0.2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet Container.

CVSS v3 Severity:

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
4.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

5.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
4.3 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2010-4437

Source: OSVDB
Type: UNKNOWN
70571

Source: CCN
Type: SA42975
Oracle WebLogic Server Three Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
42975

Source: SREASON
Type: UNKNOWN
8126

Source: CCN
Type: SECTRACK ID: 1024981
Oracle Fusion Middleware Flaws Let Remote Users Execute Arbitrary Code, Access and Modify Data, and Deny Service

Source: CCN
Type: Oracle Critical Patch Update Advisory - January 2011
Oracle Critical Patch Update Advisory - January 2011

Source: CONFIRM
Type: Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html

Source: CCN
Type: OSVDB ID: 70571
Oracle Fusion Middleware WebLogic Server Servlet Container AFSSESSIONID Cookie Session Fixation

Source: BID
Type: UNKNOWN
45852

Source: CCN
Type: BID-45852
Oracle Weblogic CVE-2010-4437 Remote Session Fixation Vulnerability

Source: SECTRACK
Type: UNKNOWN
1024981

Source: VUPEN
Type: UNKNOWN
ADV-2011-0143

Source: XF
Type: UNKNOWN
weblogic-servlet-container-unspec(64764)

Source: XF
Type: UNKNOWN
weblogic-servlet-container-unspec(64764)

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [2011-03-11]

Vulnerable Configuration:

Configuration 1:

cpe:/a:oracle:fusion_middleware:9.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:fusion_middleware:9.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:fusion_middleware:9.2.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:fusion_middleware:10.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:fusion_middleware:10.3.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:fusion_middleware:10.3.3:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:oracle:weblogic_server:9.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:weblogic_server:9.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:weblogic_server:10.3.2.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:weblogic_server:10.3.3.0.0:*:*:*:*:*:*:*

Denotes that component is vulnerable