Medium WID-SEC-2023-2681 6 CVEs

Oracle Commerce: Mehrere Schwachstellen

Published Oct 17, 2023 · Updated Oct 17, 2023 · de-DE

Vendor: Oracle Product: Commerce 11.3.2 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Commerce ist eine elektronische Handelsplattform.

Vulnerabilities 6

High 8.2

CVE-2022-41966 Public exploit

XStream Denial of Service via stack overflow

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack…

x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven

Dec 27, 2022
High 7.5

CVE-2023-28709 EPSS 48%

Apache Tomcat: Fix for CVE-2023-24998 is incomplete

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…

Apache Software Foundation Apache Tomcat tomcat10 org.apache.tomcat.embed:tomcat-embed-core Debian Maven

May 22, 2023
Medium 6.5

CVE-2021-37533

Apache Commons Net's FTP client trusts the host from PASV response by default

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…

Apache Software Foundation Apache Commons Net druid libcommons-net-java Debian Ubuntu Wolfi Maven

Dec 3, 2022
Medium 6.5

CVE-2023-20863

Spring Framework vulnerable to denial of service

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven

Apr 13, 2023
Medium 6.1

CVE-2023-22029

Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Workbench). The supported ver…

Oracle Commerce Guided Search / Oracle Commerce Experience Manager

Oct 17, 2023
Medium 5.9

CVE-2023-22043

Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u371. D…

Oracle Java SE JDK and JRE openjdk-7 openjfx Debian Ubuntu Wolfi

Jul 18, 2023

Revision history

2023-10-17 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - October 2023 - Appendix Oracle Commerce vom 2023-10-17
https://www.oracle.com/security-alerts/cpuoct2023.html#AppendixOCOM