PT-2019-3625 · Oracle · Oracle Banking Digital Experience

Published 2019-10-15 · Updated 2020-08-24 · CVE-2019-3019

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Banking Digital Experience versions 18.1 through 19.1

Description The issue is related to inadequate access control in the Loan Calculator component of Oracle Banking Digital Experience, part of Oracle Financial Services Applications. This can be exploited by a remote attacker to gain unauthorized access to modify, add, or delete data using HTTP protocols. The attack requires some interaction from a person other than the attacker and can significantly impact additional products beyond Oracle Banking Digital Experience. Successful exploitation can result in unauthorized access to update, insert, or delete some accessible data, as well as unauthorized read access to a subset of the data.

Recommendations For versions 18.1 through 19.1, consider restricting access to the Loan Calculator component until a fix is available. As a temporary workaround, limit the use of HTTP protocols for sensitive operations. Additionally, review and enforce strict access controls to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2019-03840

CVE-2019-3019

Affected Products

Oracle Banking Digital Experience

References · 4

• https://osv.dev/vulnerability/CVE-2019-3019 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03840 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3019 · Security Note