PT-2019-3718 · Oracle · Oracle Field Service+1

Publicado 2019-10-15 · Atualizado 2020-08-24 · CVE-2019-2930

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite (component: Wireless) versions 12.1.1 through 12.1.3 Oracle E-Business Suite (component: Wireless) versions 12.2.3 through 12.2.8

Description The issue is related to a vulnerability in the authentication procedure of the Oracle Field Service component. This vulnerability can be exploited by an unauthenticated attacker with network access via HTTP, allowing them to compromise Oracle Field Service. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability can result in unauthorized update, insert, or delete access to some of Oracle Field Service's accessible data.

Recommendations For versions 12.1.1 through 12.1.3, update to a version outside of this range to mitigate the risk. For versions 12.2.3 through 12.2.8, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Wireless component of Oracle Field Service to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2019-03945

CVE-2019-2930

Produtos afetados

Oracle E-Business Suite

Oracle Field Service

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-2930 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-2930 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03945 · Nota de Segurança
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Nota
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Aviso do Fabricante