PT-2019-1925 · Oracle · Oracle Service Contracts+1

Published 2019-04-16 · Updated 2020-08-24 · CVE-2019-2622

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3, 12.2.3 through 12.2.8

Description The issue is related to insufficient access controls in the Renewals subcomponent of Oracle Service Contracts, part of the Oracle E-Business Suite system. This can be exploited by a remote attacker to gain access to modify, add, or delete data using the HTTP protocol. The attack requires some interaction from a person other than the attacker and can significantly impact additional products beyond Oracle Service Contracts, resulting in unauthorized access to update, insert, or delete some accessible data.

Recommendations For versions 12.1.1 through 12.1.3, apply the necessary patches or updates to fix the access control issue in the Renewals subcomponent. For versions 12.2.3 through 12.2.8, apply the necessary patches or updates to fix the access control issue in the Renewals subcomponent. As a temporary workaround, consider restricting access to the Renewals subcomponent until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2019-01594

CVE-2019-2622

Affected Products

Oracle E-Business Suite

Oracle Service Contracts

References · 5

• http://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-2622 · Security Note
• https://bdu.fstec.ru/vul/2019-01594 · Security Note
• https://osv.dev/vulnerability/CVE-2019-2622 · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Note