PT-2019-3267 · Oracle · Micros Relate Crm

Publicado 2019-04-23 · Atualizado 2019-10-03 · CVE-2018-3314

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Oracle Retail Applications MICROS Relate CRM Software version 11.4

Description The issue is related to inadequate access control in the Customer component of the MICROS Relate CRM Software. It allows a low-privileged attacker with network access via HTTP to compromise the software. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data. The vulnerability can be exploited by sending specially crafted HTTP requests.

Recommendations For version 11.4, consider restricting access to the Customer component until a fix is available. As a temporary workaround, limit the use of HTTP requests to minimize the risk of exploitation. Additionally, review and enforce strict access controls to prevent unauthorized data modification or access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2019-03289

CVE-2018-3314

Produtos afetados

Micros Relate Crm

Referências · 5

• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Nota
• http://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-3314 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-03289 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-3314 · Nota de Segurança