PT-2019-1391 · Oracle · Oracle Hospitality Reporting/Analytics

Published 2019-01-16 · Updated 2020-08-24 · CVE-2019-2397

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Reporting and Analytics version 9.1.0

Description The issue is related to insufficient access control in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. It allows a low-privileged attacker with report privilege and logon access to the infrastructure to compromise Oracle Hospitality Reporting and Analytics. Successful attacks can result in unauthorized access to modify, add, or delete data, as well as unauthorized read access to a subset of accessible data.

Recommendations For version 9.1.0, consider restricting access to the Oracle Hospitality Reporting and Analytics component to minimize the risk of exploitation until a patch is available. Additionally, review and limit report privileges to only those necessary for operations to reduce the potential impact of an attack.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2019-00756

CVE-2019-2397

Affected Products

Oracle Hospitality Reporting/Analytics

References · 6

• https://osv.dev/vulnerability/CVE-2019-2397 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00756 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-2397 · Security Note
• http://securityfocus.com/bid/106576 · Note
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Note