Cybersecurity specialists report the detection of multiple vulnerabilities in Oracle Retail Xstore Point of Service. According to the report, successful exploitation of these flaws would allow threat actors to deploy various attack variants in addition to accessing sensitive information.
Below are brief descriptions of the flaws detected, in addition to their respective identification keys and scores assigned according to the Common Vulnerability Scoring System (CVSS).
CVE-2020-25649: Insufficient validation of user-provided XML input would allow threat actors to pass specially crafted XML to the affected application.
The vulnerability received a CVSS score of 6.5/10 and its successful exploitation would allow malicious hackers to modify information on the system.
CVE-2020-8277: Improper management of internal resources within the application when processing a large number of DNS responses could be abused by hackers using a Node.js application to activate a DNS request to a malicious host, which could lead to a denial of service (DoS) attack.
This is a medium severity flaw that received a CVSS score of 5.6/10.
CVE-2020-17527: Improper management of internal resources when processing HTTP/2 requests in Apache Tomcat would allow threat actors to extract sensitive information from HTTP requests.
The flaw received a CVSS score of 4.6/10 and its successful exploitation would allow hackers to access sensitive information.
CVE-2019-0219: Improper debugging of user input that is passed through a specially crafted gap-iab: URI would allow remote attackers to trick the victim into following a specially crafted link and executing arbitrary JavaScript code in the web view of the main app on the Android device.
The vulnerability received a score of 5.3/10 and its successful exploitation would allow hackers to perform cross-site scripting (XSS) attacks.
CVE-2021-21345: Insecure input validation when processing serialized data in the affected application allows remote attackers to pass specially crafted data to the application and execute arbitrary code on the compromised system.
The vulnerability received a CVSS score of 8.5/10.
These flaws reside in the following versions of Oracle Retail Xstore Point of Service: 16.0.6, 17.0.4, 18.0.3, and 19.0.2.
While these vulnerabilities can be exploited by threat actors remotely, cybersecurity experts have not yet found evidence of active exploitation or the existence of a malware variant associated with the attack.
The updates are now ready to be installed, which all administrators of affected versions should do as soon as possible. To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
