PT-2019-16450 · Oracle · Oracle Siebel Crm

Publicado 2019-04-23 · Atualizado 2020-08-24 · CVE-2019-2719

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 8.5.1.0 through 8.5.1.7 Oracle Siebel CRM version 8.6.0 Oracle Siebel CRM version 8.6.1

Description The issue affects the Oracle Knowledge component, specifically the Web Applications (InfoCenter) subcomponent. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized update, insert, or delete access to some of Oracle Knowledge's accessible data, as well as unauthorized read access to a subset of Oracle Knowledge's accessible data.

Recommendations For Oracle Siebel CRM versions 8.5.1.0 through 8.5.1.7, update to a version outside of this range to mitigate the risk. For Oracle Siebel CRM version 8.6.0, update to a version outside of this to mitigate the risk. For Oracle Siebel CRM version 8.6.1, update to a version outside of this to mitigate the risk. As a temporary workaround, consider restricting access to the Web Applications (InfoCenter) subcomponent until a patch is available.

Correção

Identificadores relacionados

CVE-2019-2719

Produtos afetados

Oracle Siebel Crm

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-2719 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-2719 · Nota de Segurança