Exploit Oracle Application Server Portal 10g - Authentication Bypass

[Exploiter]

EDB-ID

31770

Проверка EDB

1. Пройдено

Автор

DENIZ CEVIK

Тип уязвимости

REMOTE

Платформа

MULTIPLE

CVE

cve-2008-2138

Дата публикации

2008-05-09

source: https://www.securityfocus.com/bid/29119/info

Oracle Application Server Portal is prone to a authentication-bypass vulnerability because the application fails to properly restrict access to certain resources.

An attacker can exploit this vulnerability to bypass certain security restrictions and gain access to potentially sensitive contents of the portal.

Oracle Application Server Portal 10g is vulnerable to this issue; other versions may also be affected.

Visiting the 'http://www.example.com/portal/%0A' site will create a cookie sufficient to trigger the issue and access 'http://www.example.com/dav_portal/porta/' without authorization.