PT-2019-3781 · Oracle · Oracle Retail Xstore Point Of Service

Published 2019-10-15 · Updated 2019-10-17 · CVE-2019-2872

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Retail Xstore Point of Service versions 17.0.3, 18.0.1, 19.0.0

Description The issue is related to inadequate access control in the Point of Sale component of Oracle Retail Xstore Point of Service. Exploitation of this issue may allow an attacker to modify, add, or delete data, or gain unauthorized access to protected information. The vulnerability is difficult to exploit and requires physical access to compromise the system. Successful attacks also require human interaction from a person other than the attacker, potentially leading to unauthorized access to some data.

Recommendations For versions 17.0.3, 18.0.1, and 19.0.0, consider restricting physical access to the system to minimize the risk of exploitation. As a temporary workaround, limit human interaction with the system from unauthorized individuals until a fix is available. Restrict access to sensitive data and functions within the Point of Sale component to reduce the potential impact of unauthorized access.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-04077

CVE-2019-2872

Affected Products

Oracle Retail Xstore Point Of Service

References · 5

• https://bdu.fstec.ru/vul/2019-04077 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-2872 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-2872 · Vendor Advisory
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Note