CVE-2010-3591 - Vulnerability Details - OpenCVE

Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Internal Operations. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can overwrite or delete arbitrary files via a full pathname in the second argument to the DownloadSingleMessageToFile method in the EMPOP3Lib ActiveX component (empop3.dll).

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Oracle	Fusion Middleware

Configuration 1 [-]

OR	cpe:2.3:a:oracle:fusion_middleware:10.1.3.4:::::::*
	cpe:2.3:a:oracle:fusion_middleware:10.1.3.5:::::::*

No data.

References

Link	Providers
http://dsecrg.com/pages/vul/show.php?id=305
http://secunia.com/advisories/42976
http://www.exploit-db.com/exploits/16055
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
http://www.securityfocus.com/archive/1/515959/100/0/threaded
http://www.securityfocus.com/bid/45851
http://www.securitytracker.com/id?1024981
http://www.vupen.com/english/advisories/2011/0143
https://exchange.xforce.ibmcloud.com/vulnerabilities/64768

History

No history.

MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2011-01-19T15:00:00

Updated: 2024-08-07T03:18:51.535Z

Reserved: 2010-09-20T00:00:00

Link: CVE-2010-3591

Vulnrichment

No data.

NVD

Status : Modified

Published: 2011-01-19T16:00:02.640

Modified: 2024-11-21T01:19:11.413

Link: CVE-2010-3591

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-01-18T00:00:00", "descriptions": [{"lang": "en", "value": "Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Internal Operations. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can overwrite or delete arbitrary files via a full pathname in the second argument to the DownloadSingleMessageToFile method in the EMPOP3Lib ActiveX component (empop3.dll)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T18:57:01", "orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle"}, "references": [{"name": "ADV-2011-0143", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2011/0143"}, {"name": "16055", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/16055"}, {"tags": ["x_refsource_MISC"], "url": "http://dsecrg.com/pages/vul/show.php?id=305"}, {"name": "1024981", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1024981"}, {"name": "20110125 [DSECRG-11-005] Oracle Document Capture empop3.dll - insecure method", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/515959/100/0/threaded"}, {"name": "oracle-document-internaloperations-code-exec(64768)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64768"}, {"name": "42976", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/42976"}, {"name": "45851", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/45851"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2010-3591", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Internal Operations. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can overwrite or delete arbitrary files via a full pathname in the second argument to the DownloadSingleMessageToFile method in the EMPOP3Lib ActiveX component (empop3.dll)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2011-0143", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2011/0143"}, {"name": "16055", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/16055"}, {"name": "http://dsecrg.com/pages/vul/show.php?id=305", "refsource": "MISC", "url": "http://dsecrg.com/pages/vul/show.php?id=305"}, {"name": "1024981", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1024981"}, {"name": "20110125 [DSECRG-11-005] Oracle Document Capture empop3.dll - insecure method", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/515959/100/0/threaded"}, {"name": "oracle-document-internaloperations-code-exec(64768)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64768"}, {"name": "42976", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/42976"}, {"name": "45851", "refsource": "BID", "url": "http://www.securityfocus.com/bid/45851"}, {"name": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T03:18:51.535Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2011-0143", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2011/0143"}, {"name": "16055", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "http://www.exploit-db.com/exploits/16055"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://dsecrg.com/pages/vul/show.php?id=305"}, {"name": "1024981", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1024981"}, {"name": "20110125 [DSECRG-11-005] Oracle Document Capture empop3.dll - insecure method", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/515959/100/0/threaded"}, {"name": "oracle-document-internaloperations-code-exec(64768)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64768"}, {"name": "42976", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/42976"}, {"name": "45851", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/45851"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"}]}]}, "cveMetadata": {"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "assignerShortName": "oracle", "cveId": "CVE-2010-3591", "datePublished": "2011-01-19T15:00:00", "dateReserved": "2010-09-20T00:00:00", "dateUpdated": "2024-08-07T03:18:51.535Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:fusion_middleware:10.1.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "62C295FB-3AFC-4051-AA7F-9BC8B56B4501", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:fusion_middleware:10.1.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "17FCAA6C-F1A6-469D-9449-9A99D3E70A70", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Internal Operations. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can overwrite or delete arbitrary files via a full pathname in the second argument to the DownloadSingleMessageToFile method in the EMPOP3Lib ActiveX component (empop3.dll)."}, {"lang": "es", "value": "Vulnerabilidad sin especificar en el componente Oracle Document Capture de Oracle Fusion Middleware 10.1.3.4 y 10.1.3.5 permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a trav\u00e9s de vectores desconocidos relacionados con operaciones internas."}], "id": "CVE-2010-3591", "lastModified": "2024-11-21T01:19:11.413", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2011-01-19T16:00:02.640", "references": [{"source": "secalert_us@oracle.com", "url": "http://dsecrg.com/pages/vul/show.php?id=305"}, {"source": "secalert_us@oracle.com", "url": "http://secunia.com/advisories/42976"}, {"source": "secalert_us@oracle.com", "url": "http://www.exploit-db.com/exploits/16055"}, {"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"}, {"source": "secalert_us@oracle.com", "url": "http://www.securityfocus.com/archive/1/515959/100/0/threaded"}, {"source": "secalert_us@oracle.com", "url": "http://www.securityfocus.com/bid/45851"}, {"source": "secalert_us@oracle.com", "url": "http://www.securitytracker.com/id?1024981"}, {"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2011/0143"}, {"source": "secalert_us@oracle.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64768"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://dsecrg.com/pages/vul/show.php?id=305"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/42976"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.exploit-db.com/exploits/16055"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/515959/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/45851"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1024981"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2011/0143"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64768"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}