CVE-2010-4417 File upload in n/a
Remote attackers can upload and execute arbitrary JSP code via null byte injection in the Services for Beehive component of Oracle Fusion Middleware.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-4417?
CVE-2010-4417 is a high-severity vulnerability in n/a, published on 19 Jan 2011. It can be exploited over the network, with no action from the victim.
Official description
Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that voice-servlet/prompt-qa/Index.jspf does not properly handle null (%00) bytes in the evaluation parameter that is used in a filename, which allows attackers to create a file with an executable extension and execute arbitrary JSP code.
Which versions are affected by CVE-2010-4417?
It affects 1 product.
Products include Oracle Beehive.
How do I fix CVE-2010-4417?
No fix has been published for CVE-2010-4417 yet. Limit exposure of the affected software until one is available.
Is CVE-2010-4417 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-4417 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Sources
Also known as GHSA-gxjq-3q6x-qgmh.