Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services.

The Oracle WebLogic UDDI Explorer service in Oracle Fusion Middleware versions 10.0.2 and 10.3.6 is affected by a server-side request forgery vulnerability due to the lack of validation of the operator parameter in the SearchPublicRegistries.jsp page. A remote and unauthenticated attacker can exploit this issue to retrieve sensitive information and conduct port scanning on the target application and its internal network.

The remote host has a version of Oracle WebLogic Server installed that is affected by multiple vulnerabilities affecting multiple components.

ID	Name	Product	Family	Type	Severity
112422	Oracle WebLogic UDDI Explorer Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Check Based	medium
76527	Oracle WebLogic Server Multiple Vulnerabilities (July 2014 CPU)	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2014-4210

medium

Tenable Plugins

medium

high