Access Restriction Bypass in Oracle Application Server Portal 10g

CVE-2008-2138

What is CVE-2008-2138?

The Oracle Application Server Portal 10g is vulnerable to an access restriction bypass, allowing remote attackers to read unauthorized content located in the /dav_portal/portal/ directory. This occurs when an attacker sends a specially crafted request with a trailing '%0A' (encoded line feed), which can generate a session ID that may be improperly utilized to gain access to sensitive information. This vulnerability could pose significant risks to data integrity and confidentiality, necessitating immediate attention from organizations utilizing this server.

References