PT-2018-1429 · Oracle · Oracle Order Management+1

Published 2018-07-17 · Updated 2019-10-03 · CVE-2018-2954

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7

Description The issue is related to insufficient access control in the Product Diagnostic Tools component of Oracle Order Management, allowing a low-privileged attacker with logon access to the infrastructure to compromise Oracle Order Management. Successful attacks can result in the takeover of Oracle Order Management.

Recommendations For versions 12.1.1, 12.1.2, 12.1.3, update to a version that includes the necessary security patches to address the access control issue. For versions 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, apply the recommended security fixes to resolve the vulnerability. As a temporary workaround, consider restricting access to the Product Diagnostic Tools component until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2018-00978

CVE-2018-2954

Affected Products

Oracle E-Business Suite

Oracle Order Management

References · 6

• https://osv.dev/vulnerability/CVE-2018-2954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2954 · Security Note
• https://bdu.fstec.ru/vul/2018-00978 · Security Note
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Vendor Advisory
• http://securityfocus.com/bid/104834 · Note
• http://securitytracker.com/id/1041309 · Note