Vulnerability in Oracle Fusion Middleware
CVE-2010-3595
Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality via unknown vectors related to Import Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can read arbitrary files via a full pathname in the first argument to the ImportBodyText method in the EasyMail ActiveX control (emsmtp.dll).
EPSS: 0.119 (95.7th percentile) — read the EPSS interpretation.
Affected products
- Oracle Fusion_middleware — versions 10.1.3.4, 10.1.3.5
- N/a — versions n/a
References
- secalert_us@oracle.com (vdb-entry, x_refsource_XF)
- secalert_us@oracle.com (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- secalert_us@oracle.com (x_refsource_MISC)
- secalert_us@oracle.com (vdb-entry, x_refsource_SECTRACK)
- secalert_us@oracle.com (exploit, x_refsource_EXPLOIT-DB)
- secalert_us@oracle.com (vdb-entry, x_refsource_BID)
- secalert_us@oracle.com (x_refsource_SECUNIA, third-party-advisory)
- secalert_us@oracle.com (mailing-list, x_refsource_BUGTRAQ)
- secalert_us@oracle.com (x_refsource_CONFIRM, Vendor Advisory)