PT-2019-1925 · Oracle · Oracle Service Contracts+1

Publicado 2019-04-16 · Atualizado 2020-08-24 · CVE-2019-2622

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3, 12.2.3 through 12.2.8

Description The issue is related to insufficient access controls in the Renewals subcomponent of Oracle Service Contracts, part of the Oracle E-Business Suite system. This can be exploited by a remote attacker to gain access to modify, add, or delete data using the HTTP protocol. The attack requires some interaction from a person other than the attacker and can significantly impact additional products beyond Oracle Service Contracts, resulting in unauthorized access to update, insert, or delete some accessible data.

Recommendations For versions 12.1.1 through 12.1.3, apply the necessary patches or updates to fix the access control issue in the Renewals subcomponent. For versions 12.2.3 through 12.2.8, apply the necessary patches or updates to fix the access control issue in the Renewals subcomponent. As a temporary workaround, consider restricting access to the Renewals subcomponent until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2019-01594

CVE-2019-2622

Produtos afetados

Oracle E-Business Suite

Oracle Service Contracts

Referências · 5

• http://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Aviso do Fabricante
• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-2622 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-01594 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-2622 · Aviso do Fabricante