PT-2019-1956 · Oracle · Oracle General Ledger+1

Published

2019-04-16

·

Updated

2024-08-27

·

CVE-2019-2638

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Oracle E-Business Suite versions 12.2.3 through 12.2.8
Description The issue is related to insufficient access control in the Consolidation Hierarchy Viewer component of Oracle E-Business Suite, allowing a low-privileged attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle General Ledger accessible data, as well as unauthorized access to critical data or complete access to all Oracle General Ledger accessible data. The vulnerability can be exploited to bypass access controls and manipulate financial transactions, potentially leading to direct financial theft.
Recommendations For Oracle E-Business Suite versions 12.1.1 through 12.1.3, update to a version that includes the necessary security fixes. For Oracle E-Business Suite versions 12.2.3 through 12.2.8, update to a version that includes the necessary security fixes. As a temporary workaround, consider restricting access to the Consolidation Hierarchy Viewer component until a patch is available. Avoid using the HTTP protocol to access sensitive data in the Oracle General Ledger component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-01646
CVE-2019-2638

Affected Products

Oracle E-Business Suite
Oracle General Ledger