CVE-2014-6577

2015-01-2115:28:16

oracle

web.nvd.nist.gov

cve-2014-6577

unspecified vulnerability

xml developer's kit

oracle database server

remote authenticated users

confidentiality

xxe vulnerability

xml parser

internal port scanning

ssrf attacks

denial of service

january 2015 cpu

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:C/I:N/A:N

AI Score

5.8

Confidence

Low

EPSS

0.004

Percentile

72.7%

JSON

Unspecified vulnerability in the XML Developer’s Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the original researcher’s claim that this is an XML external entity (XXE) vulnerability in the XML parser, which allows attackers to conduct internal port scanning, perform SSRF attacks, or cause a denial of service via a crafted (1) http: or (2) ftp: URI.

Affected configurations

Nvd

Node

oracledatabase_serverMatch11.2.0.3

oracledatabase_serverMatch11.2.0.4

oracledatabase_serverMatch12.1.0.1

oracledatabase_serverMatch12.1.0.2

VendorProductVersionCPE
oracledatabase_server11.2.0.3cpe:2.3:a:oracle:database_server:11.2.0.3:*:*:*:*:*:*:*
oracledatabase_server11.2.0.4cpe:2.3:a:oracle:database_server:11.2.0.4:*:*:*:*:*:*:*
oracledatabase_server12.1.0.1cpe:2.3:a:oracle:database_server:12.1.0.1:*:*:*:*:*:*:*
oracledatabase_server12.1.0.2cpe:2.3:a:oracle:database_server:12.1.0.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	database_server	11.2.0.3	cpe:2.3:a:oracle:database_server:11.2.0.3:::::::*
oracle	database_server	11.2.0.4	cpe:2.3:a:oracle:database_server:11.2.0.4:::::::*
oracle	database_server	12.1.0.1	cpe:2.3:a:oracle:database_server:12.1.0.1:::::::*
oracle	database_server	12.1.0.2	cpe:2.3:a:oracle:database_server:12.1.0.2:::::::*