CVE-2010-3595

2011-01-1916:00:02

oracle

web.nvd.nist.gov

oracle

document capture

fusion middleware

cve-2010-3595

vulnerability

remote attackers

confidentiality

import server

easymail activex control

emsmtp.dll

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

AI Score

5.5

Confidence

Low

EPSS

0.424

Percentile

97.4%

JSON

Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality via unknown vectors related to Import Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can read arbitrary files via a full pathname in the first argument to the ImportBodyText method in the EasyMail ActiveX control (emsmtp.dll).

Affected configurations

Nvd

Node

oraclefusion_middlewareMatch10.1.3.4

oraclefusion_middlewareMatch10.1.3.5

VendorProductVersionCPE
oraclefusion_middleware10.1.3.4cpe:2.3:a:oracle:fusion_middleware:10.1.3.4:*:*:*:*:*:*:*
oraclefusion_middleware10.1.3.5cpe:2.3:a:oracle:fusion_middleware:10.1.3.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	fusion_middleware	10.1.3.4	cpe:2.3:a:oracle:fusion_middleware:10.1.3.4:::::::*
oracle	fusion_middleware	10.1.3.5	cpe:2.3:a:oracle:fusion_middleware:10.1.3.5:::::::*