Oracle Commerce: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• Critical 9.8
  CVE-2022-46364 Public exploit

  Apache CXF SSRF Vulnerability

  A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  Dec 13, 2022
• High 7.5
  CVE-2022-42003

  Uncontrolled Resource Consumption in Jackson-databind

  In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

  management-api-for-apache-cassandra-5.0 jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022
• High 7.5
  CVE-2023-1370

  Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

  [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

  json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Mar 13, 2023
• High 7.5
  CVE-2023-5072

  DoS Vulnerability in JSON-Java

  Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

  https://github.com/stleary/JSON-java openjdk17 openjdk21 libjettison-java Debian Ubuntu Alpine Maven
  Oct 12, 2023
• Medium 6.5
  CVE-2023-20863

  Spring Framework vulnerable to denial of service

  In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

  libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven
  Apr 13, 2023
• Medium 6.1
  CVE-2023-41080 Public exploit

  Apache Tomcat: Open redirect with FORM authentication

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 thr…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Aug 25, 2023
• Medium 5.5
  CVE-2023-2976

  Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

  Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

  Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  Jun 14, 2023
• Medium 4.0
  CVE-2024-21100

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Platform). Supported versions that…

  Oracle Commerce Platform
  Apr 16, 2024

Revision history

1. 2024-04-16 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Commerce vom 2024-04-16
  https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixOCOM