CVSS 3.1
4.8 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NCVE-2020-9314
Medium (4.8) in oracle iplanet web server. EPSS 1.3% chance of exploitation in the next 30 days.
Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- oracle:iplanet_web_server
References
- http://seclists.org/fulldisclosure/2020/May/31
- https://www.oracle.com/support/lifetime-support/
- https://www.oracle.com/us/assets/lifetime-support-middleware-069163.pdf
- https://wwws.nightwatchcybersecurity.com/2020/05/10/two-vulnerabilities-in-oracles-iplanet-web-server-cve-2020-9315-and-cve-2020-9314/
- http://seclists.org/fulldisclosure/2020/May/31