virus logo Intrusion Prevention

Oracle.BPEL.PM.ScriptServlet.Information.Disclosure

description-logoDescription

This indicates an attack attempt against an Information Disclosure vulnerability in Oracle BPEL Process Manager.
The vulnerability is due to an insufficient input validation error when handling a crafted HTTP request. A remote attacker can exploit this to gain unauthorized access to sensitive information via a crafted HTTP request.

affected-products-logoAffected Products

Oracle BPEL Process Manager 10.1.x up to 10.1.3.5.0
Oracle BPEL Process Manager 11.1.x up to 11.1.1.6.0

Impact logoImpact

Information Disclosure: Remote attackers can gain sensitive information from vulnerable systems.

recomended-action-logoRecommended Actions

Apply the most recent upgrade or patch from the vendor.
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)

References

http://www.zerodayinitiative.com/advisories/ZDI-13-249/
ID 37601
Created Dec 19, 2013
Updated Apr 23, 2014
Risk black-background-circle-icon black-background-circle-icon black-background-circle-icon lightgray-background-circle-icon lightgray-background-circle-icon
CVE ID CVE-2013-3828
Exploit Prediction Score 19.82%
Default Action drop
Active
Affected OS All
Affected App Oracle