PT-2019-1309 · Oracle · Oracle Flexcube Direct Banking

Publicado 2019-01-16 · Atualizado 2020-08-24 · CVE-2019-2549

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle FLEXCUBE Direct Banking version 12.0.2

Description The issue is related to insufficient access control in the Oracle FLEXCUBE Direct Banking component, specifically in the Logoff Page. This can be exploited by a remote attacker to gain unauthorized access to protected information using the HTTP protocol. Successful attacks require human interaction and can result in unauthorized access to some data, including update, insert, or delete access, as well as read access to a subset of the data.

Recommendations For version 12.0.2, consider restricting access to the Logoff Page until a patch is available to prevent unauthorized access. As a temporary workaround, limit the use of the HTTP protocol for sensitive operations to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2019-00580

CVE-2019-2549

Produtos afetados

Oracle Flexcube Direct Banking

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-2549 · Nota de Segurança
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Nota
• https://bdu.fstec.ru/vul/2019-00580 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-2549 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Aviso do Fabricante
• http://securityfocus.com/bid/106613 · Nota