CVE-2018-2996 : Vulnerability in the Oracle Applications Manager component of Oracle E-Business

Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite (subcomponent: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Published 2018-07-18 13:29:05

Updated 2019-10-03 00:03:26

Source Oracle

View at NVD, CVE.org

Vulnerability category: Bypass

Products affected by CVE-2018-2996

Oracle » Applications Manager » Version: 12.1.3
cpe:2.3:a:oracle:applications_manager:12.1.3:*:*:*:*:*:*:*
Matching versions
Oracle » Applications Manager » Version: 12.2.6
cpe:2.3:a:oracle:applications_manager:12.2.6:*:*:*:*:*:*:*
Matching versions
Oracle » Applications Manager » Version: 12.2.3
cpe:2.3:a:oracle:applications_manager:12.2.3:*:*:*:*:*:*:*
Matching versions
Oracle » Applications Manager » Version: 12.2.4
cpe:2.3:a:oracle:applications_manager:12.2.4:*:*:*:*:*:*:*
Matching versions
Oracle » Applications Manager » Version: 12.2.5
cpe:2.3:a:oracle:applications_manager:12.2.5:*:*:*:*:*:*:*
Matching versions
Oracle » Applications Manager » Version: 12.2.7
cpe:2.3:a:oracle:applications_manager:12.2.7:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-2996

EPSS FAQ

2.82%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 85 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-2996

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2018-2996

http://www.securitytracker.com/id/1041309

Oracle E-Business Suite Multiple Flaws Let Remote Users Access and Modify Data and Let Local Users Gain Elevated Privileges on the Target System - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/bid/104837

Oracle E-Business Suite CVE-2018-2996 Remote Security Vulnerability
Third Party Advisory;VDB Entry
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

CPU July 2018
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-2996

Products affected by CVE-2018-2996

Exploit prediction scoring system (EPSS) score for CVE-2018-2996

CVSS scores for CVE-2018-2996

References for CVE-2018-2996