PT-2019-1391 · Oracle · Oracle Hospitality Reporting/Analytics

Publicado 2019-01-16 · Atualizado 2020-08-24 · CVE-2019-2397

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Reporting and Analytics version 9.1.0

Description The issue is related to insufficient access control in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. It allows a low-privileged attacker with report privilege and logon access to the infrastructure to compromise Oracle Hospitality Reporting and Analytics. Successful attacks can result in unauthorized access to modify, add, or delete data, as well as unauthorized read access to a subset of accessible data.

Recommendations For version 9.1.0, consider restricting access to the Oracle Hospitality Reporting and Analytics component to minimize the risk of exploitation until a patch is available. Additionally, review and limit report privileges to only those necessary for operations to reduce the potential impact of an attack.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2019-00756

CVE-2019-2397

Produtos afetados

Oracle Hospitality Reporting/Analytics

Referências · 6

• http://securityfocus.com/bid/106576 · Nota
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Nota
• https://osv.dev/vulnerability/CVE-2019-2397 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00756 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-2397 · Nota de Segurança