PT-2018-1429 · Oracle · Oracle Order Management+1

Publicado 2018-07-17 · Atualizado 2019-10-03 · CVE-2018-2954

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7

Description The issue is related to insufficient access control in the Product Diagnostic Tools component of Oracle Order Management, allowing a low-privileged attacker with logon access to the infrastructure to compromise Oracle Order Management. Successful attacks can result in the takeover of Oracle Order Management.

Recommendations For versions 12.1.1, 12.1.2, 12.1.3, update to a version that includes the necessary security patches to address the access control issue. For versions 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, apply the recommended security fixes to resolve the vulnerability. As a temporary workaround, consider restricting access to the Product Diagnostic Tools component until a patch is available.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2018-00978

CVE-2018-2954

Produtos afetados

Oracle E-Business Suite

Oracle Order Management

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-2954 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-2954 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00978 · Nota de Segurança
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Aviso do Fabricante
• http://securityfocus.com/bid/104834 · Nota
• http://securitytracker.com/id/1041309 · Nota