CVE-2019-2904: Oracle ADF Faces Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle ADF Faces. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Remote Regions component. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the web server.
Other sources
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-2904?
CVE-2019-2904 is a vulnerability in Oracle ADF Faces that allows an unauthenticated attacker to execute remote code.
Which versions of Oracle ADF Faces are affected by CVE-2019-2904?
The affected versions of Oracle ADF Faces are 11.1.1.9.0, 12.1.3.0.0, and 12.2.1.3.0.
How severe is CVE-2019-2904?
CVE-2019-2904 has a severity rating of 9.8, which is considered critical.
How can an attacker exploit CVE-2019-2904?
An attacker can exploit CVE-2019-2904 by sending malicious data via HTTP to the Oracle JDeveloper and ADF product.
Where can I find more information about CVE-2019-2904?
You can find more information about CVE-2019-2904 in the Oracle Security Advisories: CPUOct2019, CPUApr2020, and CPUApr2021.