CVE-2013-1559
Oracle WebCenter Content CheckOutAndOpen.dll ActiveX coao/openWebdav Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors related to Content Server.
Vulnerabilidad no especificada en el componente Oracle WebCenter Content en Oracle Fusion Middleware v10.1.3.5.1 y v11.1.1.6.0 permite a usuarios remotos autenticados afectar a la disponibilidad a través de vectores desconocidos relacionados con Content Server.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle WebCenter Content. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the CheckOutAndOpen.dll ActiveX control's coao and openWebdav methods. By specifying a carefully constructed path an attacker can force the contents of the file to be passed to ShellExecuteExW. An attacker can leverage this vulnerability to execute code under the context of the current user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-01-30 CVE Reserved
- 2013-04-17 CVE Published
- 2013-06-05 First Exploit
- 2024-08-06 CVE Updated
- 2024-11-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/25979 | 2013-06-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 | 2013-10-11 | |
| http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html | 2013-10-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Oracle Search vendor "Oracle" | Fusion Middleware Search vendor "Oracle" for product "Fusion Middleware" | 10.1.3.5.1 Search vendor "Oracle" for product "Fusion Middleware" and version "10.1.3.5.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Fusion Middleware Search vendor "Oracle" for product "Fusion Middleware" | 11.1.1.6.0 Search vendor "Oracle" for product "Fusion Middleware" and version "11.1.1.6.0" | - |
Affected
| ||||||