PT-2019-3718 · Oracle · Oracle Field Service+1

Published 2019-10-15 · Updated 2020-08-24 · CVE-2019-2930

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite (component: Wireless) versions 12.1.1 through 12.1.3 Oracle E-Business Suite (component: Wireless) versions 12.2.3 through 12.2.8

Description The issue is related to a vulnerability in the authentication procedure of the Oracle Field Service component. This vulnerability can be exploited by an unauthenticated attacker with network access via HTTP, allowing them to compromise Oracle Field Service. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability can result in unauthorized update, insert, or delete access to some of Oracle Field Service's accessible data.

Recommendations For versions 12.1.1 through 12.1.3, update to a version outside of this range to mitigate the risk. For versions 12.2.3 through 12.2.8, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Wireless component of Oracle Field Service to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2019-03945

CVE-2019-2930

Affected Products

Oracle E-Business Suite

Oracle Field Service

References · 5

• https://osv.dev/vulnerability/CVE-2019-2930 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-2930 · Security Note
• https://bdu.fstec.ru/vul/2019-03945 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Note