PT-2019-3598 · Oracle · Oracle Hospitality Res 3700

Published 2019-10-15 · Updated 2023-01-31 · CVE-2019-3025

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Hospitality RES 3700 version 5.7

Description The issue is related to insufficient access controls in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. It allows a remote attacker to gain full control over the application using HTTP protocols. Successful exploitation can result in the takeover of Oracle Hospitality RES 3700 and may significantly impact additional products.

Recommendations For version 5.7, update to a version that includes a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the Oracle Hospitality RES 3700 component to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2019-03808

CVE-2019-3025

Affected Products

Oracle Hospitality Res 3700

References · 6

• 🔥 http://packetstormsecurity.com/files/157746/Oracle-Hospitality-RES-3700-5.7-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48477 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3025 · Security Note
• https://bdu.fstec.ru/vul/2019-03808 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3025 · Vendor Advisory