PT-2018-2955 · Oracle · Oracle Text+3

Publicado 2018-10-18 · Atualizado 2020-08-24 · CVE-2019-2753

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, and 18c

Description The issue is related to the Oracle Text component of Oracle Database Server, where an easily exploitable vulnerability allows a low-privileged attacker with Create Session privilege and network access via OracleNet to compromise Oracle Text. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized read access to a subset of Oracle Text accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Text.

Recommendations For versions 11.2.0.4, 12.1.0.2, 12.2.0.1, and 18c, update to a version that includes the fix for this issue to prevent unauthorized access and denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2019-02733

CVE-2019-2753

Produtos afetados

Oracle Database

Oracle Database Server

Oracle Text

Oracle Net

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-2753 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpujul2019-5072835.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02733 · Nota de Segurança
• https://oracle.com/technetwork/security-advisory/cpujul2019-5072835.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-2753 · Nota de Segurança