PT-2019-3267 · Oracle · Micros Relate Crm

Published 2019-04-23 · Updated 2019-10-03 · CVE-2018-3314

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Oracle Retail Applications MICROS Relate CRM Software version 11.4

Description The issue is related to inadequate access control in the Customer component of the MICROS Relate CRM Software. It allows a low-privileged attacker with network access via HTTP to compromise the software. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data. The vulnerability can be exploited by sending specially crafted HTTP requests.

Recommendations For version 11.4, consider restricting access to the Customer component until a fix is available. As a temporary workaround, limit the use of HTTP requests to minimize the risk of exploitation. Additionally, review and enforce strict access controls to prevent unauthorized data modification or access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-03289

CVE-2018-3314

Affected Products

Micros Relate Crm

References · 5

• http://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3314 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03289 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-3314 · Security Note
• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Note