CVE-2010-4417

EPSS 78.7%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 78.7%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

09 Jun 2010Metasploit module available

19 Jan 2011Published on NVD

03 Dec 2015Public PoC

Weaponization speed

1778 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that voice-servlet/prompt-qa/Index.jspf does not properly handle null (%00) bytes in the evaluation parameter that is used in a filename, which allows attackers to create a file with an executable extension and execute arbitrary JSP code.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/38859/unverified exploitdbwww.exploit-db.com/exploits/38859unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/42978 https://exchange.xforce.ibmcloud.com/vulnerabilities/64772 https://www.exploit-db.com/exploits/38859/http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html http://www.securityfocus.com/bid/45854 http://www.securitytracker.com/id?1024981 http://www.vupen.com/english/advisories/2011/0143 http://www.zerodayinitiative.com/advisories/ZDI-11-020/