QID 376425

Date Published: 2022-02-17

QID 376425: Oracle Hypertext Transfer Protocol Server (HTTP Server) Multiple Vulnerabilities (Log4Shell) (Doc_ID_2817011.1)

Oracle HTTP Server is the Web server component for Oracle Fusion Middleware. It provides a listener for Oracle WebLogic Server and the framework for hosting static pages, dynamic pages, and applications over the Web.

Affected Versions:,

QID Detection Logic (Authenticated):
This QID checks the vulnerable version of Oracle HTTP Server from file "inventory.xml" from the Home Directory.

NOTE: As per Doc_ID_2817011.1 we are checking for following patches:
Oracle HTTP Server (Standalone) Patch 33699205,Patch 33735326,Patch 33791665
Oracle HTTP Server (Standalone) Patch 33727616,Patch 33735326,Patch 33791665

Successful exploitation of this vulnerability could lead to remote code execution (RCE) on the target

  • CVSS V3 rated as High - 7.5 severity.
  • CVSS V2 rated as High - 6 severity.
  • Solution
    The vendor has released patches for these issues. Customers are advised to refer to Doc_ID_2817011.1 for detailed information.

    CVEs related to QID 376425

    Software Advisories
    Advisory ID Software Component Link
    Doc_ID_2817011.1 URL Logo support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=281944458369898&id=2817011.1&_afrWindowMode=0&_adf.ctrl-state=1cakmcw378_396