PT-2019-16450 · Oracle · Oracle Siebel Crm

Published 2019-04-23 · Updated 2020-08-24 · CVE-2019-2719

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 8.5.1.0 through 8.5.1.7 Oracle Siebel CRM version 8.6.0 Oracle Siebel CRM version 8.6.1

Description The issue affects the Oracle Knowledge component, specifically the Web Applications (InfoCenter) subcomponent. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized update, insert, or delete access to some of Oracle Knowledge's accessible data, as well as unauthorized read access to a subset of Oracle Knowledge's accessible data.

Recommendations For Oracle Siebel CRM versions 8.5.1.0 through 8.5.1.7, update to a version outside of this range to mitigate the risk. For Oracle Siebel CRM version 8.6.0, update to a version outside of this to mitigate the risk. For Oracle Siebel CRM version 8.6.1, update to a version outside of this to mitigate the risk. As a temporary workaround, consider restricting access to the Web Applications (InfoCenter) subcomponent until a patch is available.

Fix

Related Identifiers

CVE-2019-2719

Affected Products

Oracle Siebel Crm

References · 3

• https://osv.dev/vulnerability/CVE-2019-2719 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-2719 · Security Note