CVE-2018-3000 : Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management Sys

Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: SPMS Suite). The supported version that is affected is 8.x. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality Cruise Shipboard Property Management System executes to compromise Oracle Hospitality Cruise Shipboard Property Management System. While the vulnerability is in Oracle Hospitality Cruise Shipboard Property Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Published 2018-07-18 13:29:05

Updated 2019-10-03 00:03:26

Source Oracle

View at NVD, CVE.org

Vulnerability category: Bypass

Products affected by CVE-2018-3000

Oracle » Hospitality Cruise Shipboard Property Management System » Version: 8.0
cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:8.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-3000

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 39 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-3000

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.1	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	2.5	4.0	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None

References for CVE-2018-3000

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

CPU July 2018
Patch;Vendor Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1041300

Oracle Hospitality Applications Multiple Flaws Let Remote and Local Users Access Data, Remote Authenticated Users Modify Data and Deny Service, and Local Users Gain Elevated Privileges - SecurityTrack
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/bid/104815

Oracle Hospitality Cruise Shipboard Property Management System Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-3000

Products affected by CVE-2018-3000

Exploit prediction scoring system (EPSS) score for CVE-2018-3000

CVSS scores for CVE-2018-3000

References for CVE-2018-3000