Oracle Integration Gateway Directory Traversal Vulnerability

1. ADVISORY INFORMATION
Title:  Directory Traversal vulnerability in Integration Gateway (PSIGW)
Advisory ID: [ERPSCAN-17-038]
Advisory URL: https://erpscan.com/advisories/erpscan-17-038-directory-traversal-vulnerability-integration-gateway-psigw/
Risk: High
Date published: 18.07.2017
Vendor contacted: Oracle

2. VULNERABILITY INFORMATION
Class: Directory Traversal
Impact: Read, delete, rewrite file from the system
Remotely Exploitable: Yes
CVE Name: CVE-2017-10061

CVSS Information
CVSS Base Score v3: 8.3 / 10
CVSS Base Vector:

AV: Attack Vector (Related exploit range) Network (N)
AC: Attack Complexity (Required attack complexity) Low (L)
PR: Privileges Required (Level of privileges needed to exploit) None (N)
UI: User Interaction (Required user participation) None (N)
S: Scope (Change in scope due to impact caused to components beyond
the vulnerable component) Changed (C)
C: Impact to Confidentiality Low (L)
I: Impact to Integrity Low (L)
A: Impact to Availability Low (L)

3. VULNERABILITY DESCRIPTION
Oracle PeopleSoft HCM 9.2 suffers from one critical and several
directory traversal vulnerabilities which can be leveraged to get
remote command execution on the server.

Some well-known impacts of Directory Traversal vulnerability are -
- attacker could read content of arbitrary files on the remote server
and expose sensitive data
- attacker could overwrite, delete, or corrupt arbitrary files on the
remote server

4. VULNERABLE PACKAGES

Oracle PeopleSoft HCM 9.2

5. SOLUTIONS AND WORKAROUNDS
To correct this vulnerability, implement Oracle CPU July 2017
(http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html)

6. AUTHOR
Roman Shalymov


#  0day.today [2018-04-08]  #