CVE-2018-2904 : Vulnerability in the Oracle Communications EAGLE LNP Application Processor compo

Vulnerability in the Oracle Communications EAGLE LNP Application Processor component of Oracle Communications Applications (subcomponent: GUI). The supported version that is affected is 10.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE LNP Application Processor. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications EAGLE LNP Application Processor accessible data as well as unauthorized read access to a subset of Oracle Communications EAGLE LNP Application Processor accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Published 2018-07-18 13:29:01

Updated 2019-10-03 00:03:26

Source Oracle

View at NVD, CVE.org

Products affected by CVE-2018-2904

Oracle » Communications Eagle Local Number Portability Application Processor » Version: 10.1
cpe:2.3:a:oracle:communications_eagle_local_number_portability_application_processor:10.1:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Eagle Local Number Portability Application Processor » Version: 10.0
cpe:2.3:a:oracle:communications_eagle_local_number_portability_application_processor:10.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-2904

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-2904

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:P/A:N	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	3.9	2.5	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

References for CVE-2018-2904

http://www.securitytracker.com/id/1041297

Oracle Communications Applications Flaw in EAGLE LNP Application Processor GUI Component Lets Remote Users Partially Access and Modify Data - SecurityTracker
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/104798

Oracle Communications EAGLE LNP Application Processor CVE-2018-2904 Remote Security Vulnerability
Third Party Advisory;VDB Entry
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

CPU July 2018
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-2904

Products affected by CVE-2018-2904

Exploit prediction scoring system (EPSS) score for CVE-2018-2904

CVSS scores for CVE-2018-2904

References for CVE-2018-2904