CVE-2019-2414: High severity oracle http server vulnerability

Published Jan 16, 2019

Updated

Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Software

1 affected component

Oracle HTTP Server=12.2.1.3.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Event History

Jan 16, 2019

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:30 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-2414?

CVE-2019-2414 is rated as a high-severity vulnerability due to its potential for exploitation by low-privileged attackers.

How do I fix CVE-2019-2414?

To mitigate CVE-2019-2414, upgrade to a patched version of Oracle HTTP Server as provided in Oracle's security advisory.

What versions of Oracle HTTP Server are affected by CVE-2019-2414?

CVE-2019-2414 specifically affects Oracle HTTP Server version 12.2.1.3.0.

Can CVE-2019-2414 be exploited remotely?

CVE-2019-2414 requires an attacker to have logon access to the infrastructure where Oracle HTTP Server is executed, making remote exploitation unlikely.

Is there any workaround for CVE-2019-2414?

Currently, the recommended approach to address CVE-2019-2414 is to apply the latest security updates from Oracle.