Fusion Middleware Mapviewer

Vendor:

First CVE: Apr 17, 2017 · Active for 9 years

13

Total CVEs

More Total CVEs than 91% of tracked products

2.6

Avg CVEs / Year

Higher CVE frequency than 75% of tracked products

7.8

Avg CVSS

Higher Avg CVSS than 63% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Fusion Middleware Mapviewer over time

Volume of CVEsAvg CVSS Base Score

First CVE

Apr 17, 2017

9 years ago

Most Recent CVE

Apr 13, 2021

1,928 days ago

CVE Severity & Scoring

Fusion Middleware Mapviewer13 CVEs

38%

31%

All CVEs352,231 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local0 (0.0%)

Network13 (100.0%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low12 (92.3%)

High1 (7.7%)

Unknown0 (0.0%)

User Interaction

None9 (69.2%)

Unknown0 (0.0%)

Required4 (30.8%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None13 (100.0%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (13 CVEs).

13 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2017-5645CRITICAL In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payloa	Apr 17, 2017	9.8	86	NO	YES
CVE-2019-11358MEDIUM jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob	Apr 20, 2019	6.1	78	NO	YES
CVE-2019-13990CRITICAL initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.	Jul 26, 2019	9.8	40	NO	NO
CVE-2018-8013CRITICAL In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no	May 24, 2018	9.8	39	NO	NO
CVE-2015-9251MEDIUM jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses	Jan 18, 2018	6.1	34	NO	NO
CVE-2019-17566HIGH Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker co	Nov 12, 2020	7.5	29	NO	NO
CVE-2020-11987HIGH Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could	Feb 24, 2021	8.2	28	NO	NO
CVE-2018-2943CRITICAL Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported versions that are affected are 12.2.1.2.0 and 1	Jul 18, 2018	9.8	28	NO	NO
CVE-2021-29425MEDIUM In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value,	Apr 13, 2021	4.8	23	NO	NO
CVE-2019-10219MEDIUM A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments an	Nov 8, 2019	6.1	23	NO	NO

View all 13 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (13 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

1 CVE

7.7% of CVEs· 97th percentile

ExploitDB

1 CVE

7.7% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (13 CVEs).

Media Mentions

Signals from CVEs in this product scope (13 CVEs).

Top CNAs Publishing CVEs For Fusion Middleware Mapviewer

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
12.2.1.4.0	5	6.5	7.6%	0
12.2.1.3.0	6	7.7	22.9%	1
12.2.1.3	2	9.8	54.3%	1
12.2.1.2.0	1	9.8	2.3%	0
12.2.1.2	3	9.4	36.9%	1
12.2.1.1	1	8.6	2.0%	0
11.1.1.9	1	8.6	2.0%	0