CVE-2018-2809 : Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle Peopl

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Homepage & Navigation). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).

Published 2018-04-19 02:29:04

Updated 2019-10-03 00:03:26

Source Oracle

View at NVD, CVE.org

Products affected by CVE-2018-2809

Oracle » Peoplesoft Enterprise Peopletools » Version: 8.55
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*
Matching versions
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.54
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.54:*:*:*:*:*:*:*
Matching versions
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.56
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-2809

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 54 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-2809

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

References for CVE-2018-2809

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Oracle Critical Patch Update - April 2018
Patch;Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/103890

Oracle PeopleSoft Enterprise PeopleTools CVE-2018-2809 Remote Security Vulnerability
Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1040701

Oracle PeopleSoft Products Multiple Flaws Let Remote Users Access and Modify Data and Deny Service, Remote Authenticated Users Gain Elevated Privileges, and Local Users Access Data on the Target Syste
Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-2809

Products affected by CVE-2018-2809

Exploit prediction scoring system (EPSS) score for CVE-2018-2809

CVSS scores for CVE-2018-2809

References for CVE-2018-2809