The vulnerability of the ADF Faces sub-component of the Oracle JDeveloper component and the ADF software platform of Oracle Fusion Middleware allows a perpetrator to gain full control over the application.

🗓️ 11 Nov 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Access control flaw in Oracle ADF Faces and ADF platform lets remote attacker gain control via Hypertext Transfer Protocol.

Reporter	Title	Published	Views	Family All 25
Circl	CVE-2019-2904	9 Jan 202414:46	–	circl
CNVD	Oracle JDeveloper and ADF Unauthorized Access Vulnerability	16 Oct 201900:00	–	cnvd
Check Point Advisories	Oracle JDeveloper ADF Faces Insecure Deserialization (CVE-2019-2904)	27 Apr 202000:00	–	checkpoint_advisories
CVE	CVE-2019-2904	16 Oct 201917:40	–	cve
Cvelist	CVE-2019-2904	16 Oct 201917:40	–	cvelist
EUVD	EUVD-2019-12543	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Oracle Fusion Middleware	22 Oct 202000:00	–	ncsc
NCSC	Vulnerabilities fixed in Oracle Supply Chain	21 Apr 202100:00	–	ncsc
NVD	CVE-2019-2904	16 Oct 201918:15	–	nvd
Oracle	Oracle Critical Patch Update Advisory - April 2020	14 Apr 202000:00	–	oracle

Vulners

Node

oracle fusion_middlewareMatch11.1.1.9.0

oracle fusion_middlewareMatch12.1.3.0.0

oracle fusion_middlewareMatch12.2.1.3.0

oracle enterprise_repositoryMatch11.1.1.7.0

oracle business_process_management_suiteMatch12.2.1.3.0

oracle hyperion_planningMatch11.1.2.4

oracle application_testing_suiteMatch13.3.0.1

oracle application_testing_suiteMatch12.5.0.3

oracle application_testing_suiteMatch13.1.0.1

oracle application_testing_suiteMatch13.2.0.1

oracle oracle_retail_clearance_optimization_engineMatch14.0.5

oracle oracle_hyperion_financial_close_managementMatch11.1.2.4

oracle oracle_retail_assortment_planningMatch16.0.3

oracle banking_platformMatch2.5.0

oracle banking_platformMatch2.6.0

oracle banking_platformMatch2.6.1

oracle banking_platformMatch2.6.2

oracle banking_enterprise_product_manufacturingMatch2.7.0

oracle banking_enterprise_product_manufacturingMatch2.8.0

oracle oracle_flexcube_private_bankingMatch12.0

oracle oracle_flexcube_private_bankingMatch12.1

oracle banking_platformMatch2.4.0

oracle banking_platformMatch2.4.1

oracle banking_platformMatch2.7.0

oracle banking_platformMatch2.7.2

oracle banking_platformMatch2.7.1

oracle banking_platformMatch2.9.0

oracle clinicalMatch5.2

oracle oracle_health_sciences_data_management_workbenchMatch2.4

oracle oracle_health_sciences_data_management_workbenchMatch2.5

oracle oracle_retail_assortment_planningMatch15.0.3

oracle oracle_retail_markdown_optimizationMatch13.4

oracle oracle_retail_sales_auditMatch15.0.3

oracle oracle_retail_sales_auditMatch16.0.2

oracle oracle_communications_service_brokerMatch6.0

oracle oracle_communications_service_brokerMatch6.1

oracle oracle_communications_services_gatekeeperMatch6.0

oracle oracle_communications_services_gatekeeperMatch6.1

oracle oracle_banking_enterprise_collectionsMatch2.7.0

oracle oracle_banking_enterprise_collectionsMatch2.8.0

oracle oracle_banking_enterprise_originationsMatch2.7.0

oracle oracle_banking_enterprise_originationsMatch2.8.0

oracle oracle_financial_services_revenue_management_and_billingMatch2.6

oracle oracle_financial_services_revenue_management_and_billingMatch2.7

oracle oracle_financial_services_revenue_management_and_billingMatch2.8

oracle business_process_management_suiteMatch12.2.1.4.0

oracle communications_diameter_signaling_routerRange8.0.0.0–8.4.0.5

Source	Link
oracle	www.oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html
oracle	www.oracle.com/security-alerts/cpujan2020.html
oracle	www.oracle.com/security-alerts/cpuapr2020.html
oracle	www.oracle.com/security-alerts/cpuoct2020.html
web	www.web.nvd.nist.gov/view/vuln/detail

17 Nov 2020 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 39.8

CVSS 210

EPSS0.10696