PT-2019-5600 · Oracle · Oracle Database Server Application Express

Published 2019-07-23 · Updated 2020-08-24 · CVE-2019-2484

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server Application Express versions 5.1 and 18.2

Description The issue is related to insufficient access control in the Application Express component, allowing a low-privileged attacker with a valid account and network access via HTTP to compromise Application Express. Successful attacks require human interaction and can result in unauthorized update, insert, or delete access to some Application Express accessible data, as well as unauthorized read access to a subset of Application Express accessible data. The vulnerability can significantly impact additional products.

Recommendations For version 5.1, update to a version that includes the fix for this issue. For version 18.2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Application Express component to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2020-04650

CVE-2019-2484

Affected Products

Oracle Database Server Application Express

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-2484 · Security Note
• http://oracle.com/technetwork/security-advisory/cpujul2019-5072835.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04650 · Security Note
• https://osv.dev/vulnerability/CVE-2019-2484 · Vendor Advisory
• https://securityfocus.com/bid/109214 · Note
• https://oracle.com/security-alerts/cpujul2019.html · Note