PT-2019-5600 · Oracle · Oracle Database Server Application Express

Publicado 2019-07-23 · Atualizado 2020-08-24 · CVE-2019-2484

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server Application Express versions 5.1 and 18.2

Description The issue is related to insufficient access control in the Application Express component, allowing a low-privileged attacker with a valid account and network access via HTTP to compromise Application Express. Successful attacks require human interaction and can result in unauthorized update, insert, or delete access to some Application Express accessible data, as well as unauthorized read access to a subset of Application Express accessible data. The vulnerability can significantly impact additional products.

Recommendations For version 5.1, update to a version that includes the fix for this issue. For version 18.2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Application Express component to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2020-04650

CVE-2019-2484

Produtos afetados

Oracle Database Server Application Express

Referências · 6

• https://securityfocus.com/bid/109214 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-2484 · Nota de Segurança
• http://oracle.com/technetwork/security-advisory/cpujul2019-5072835.html · Aviso do Fabricante
• https://oracle.com/security-alerts/cpujul2019.html · Nota
• https://bdu.fstec.ru/vul/2020-04650 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-2484 · Aviso do Fabricante