Session Hijacking Vulnerability in Oracle WebCenter Interaction Portal

CVE-2018-16958

Summary

A vulnerability has been identified in Oracle WebCenter Interaction Portal 10.3.3, where the ASP.NET_SessionID primary session cookie lacks the HttpOnly attribute when deployed on Internet Information Services (IIS) with ASP.NET. This oversight leaves the session cookie vulnerable to interception through JavaScript execution in the context of the portal installation, enabling potential session hijacking attacks by malicious actors. It is important to note that this vulnerability cannot be mitigated by customers, as the HttpOnly attribute cannot be enabled, further emphasizing the need for increased awareness and security measures in organizations using this unsupported product.

References