cvelistv5 - cve-2018-2747

CVE-2018-2747 (GCVE-0-2018-2747)

Vulnerability from cvelistv5 – Published: 2018-04-19 02:00 – Updated: 2024-10-03 20:23

Summary

Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Severity ?

No CVSS data available.

CWE

Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data.

Assigner

oracle

References

URL

Tags

	http://www.securitytracker.com/id/1040693	vdb-entryx_refsource_SECTRACK
	http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/103844	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	Oracle Corporation	FLEXCUBE Universal Banking	Affected: 11.3.0 Affected: 11.4.0 Affected: 12.0.1 Affected: 12.0.2 Affected: 12.0.3 Affected: 12.1.0 Affected: 12.2.0 Affected: 12.3.0 Affected: 12.4.0 Affected: 14.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:29:44.446Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1040693",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1040693"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
          },
          {
            "name": "103844",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103844"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-2747",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-03T19:24:58.517296Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-03T20:23:07.974Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FLEXCUBE Universal Banking",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "11.3.0"
            },
            {
              "status": "affected",
              "version": "11.4.0"
            },
            {
              "status": "affected",
              "version": "12.0.1"
            },
            {
              "status": "affected",
              "version": "12.0.2"
            },
            {
              "status": "affected",
              "version": "12.0.3"
            },
            {
              "status": "affected",
              "version": "12.1.0"
            },
            {
              "status": "affected",
              "version": "12.2.0"
            },
            {
              "status": "affected",
              "version": "12.3.0"
            },
            {
              "status": "affected",
              "version": "12.4.0"
            },
            {
              "status": "affected",
              "version": "14.0.0"
            }
          ]
        }
      ],
      "datePublic": "2018-03-27T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-04-19T09:57:01",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "1040693",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1040693"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
        },
        {
          "name": "103844",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103844"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2018-2747",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "FLEXCUBE Universal Banking",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "11.3.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "11.4.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "12.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "12.0.2"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "12.0.3"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "12.1.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "12.2.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "12.3.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "12.4.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "14.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1040693",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1040693"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
            },
            {
              "name": "103844",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103844"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2018-2747",
    "datePublished": "2018-04-19T02:00:00",
    "dateReserved": "2017-12-15T00:00:00",
    "dateUpdated": "2024-10-03T20:23:07.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_corporate_lending:12.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"38C8F66A-D6CC-4B59-B2FC-299A4332360F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_corporate_lending:12.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3AB5104F-057C-4887-BEAF-7A59D11DFB23\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_corporate_lending:12.5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F6A9144-B6C5-482B-B91E-58BC196FFA68\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_corporate_lending:14.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A29D91D2-687E-4671-88DC-9D36BB5EDAB7\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_payments:12.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5723C585-7087-46F1-949C-FED9A56A386A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_payments:12.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ADFA6852-C1B5-4778-A238-40A8FAB46DD5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_payments:12.5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF33F6D1-56E6-414A-B0FB-B09A2E6154AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_payments:14.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7BE6EB99-98BF-49A2-8890-829320607A1B\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_enterprise_limits_and_collateral_management:12.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"90447192-DB29-41D5-AF1F-0364A2893ED4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_enterprise_limits_and_collateral_management:14.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8D061FB7-A8B4-4D2C-BB76-38B977F1A12B\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B0A34DF8-72CC-4A8E-84F2-C2DF4A0B9FAB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"21BE77B2-6368-470E-B9E6-21664D9A818A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3250073F-325A-4AFC-892F-F2005E3854A5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0DDDC9C2-33D6-4123-9ABC-C9B809A6E88E\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_universal_banking:11.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BDAB2438-6836-4632-A344-3486F0661D17\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_universal_banking:11.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4703D070-2171-4501-9EF1-A417AB111D95\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_universal_banking:12.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"501D0455-4A7E-496A-9D92-CD2A0E9ECC62\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_universal_banking:12.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"097B84AB-C16F-48B4-BFCE-DB87D607EC5C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_universal_banking:12.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"77C313ED-A2A5-4BD2-B88F-F8F5DA2DAFAF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_universal_banking:12.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E9EF4050-D40E-4D2E-91B9-5387B2464208\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_universal_banking:12.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0CA52AE9-989E-40B4-A9CF-9E45EABEB54B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_universal_banking:12.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"77DAFCA5-2BAD-4382-8AEB-862E10B87161\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F3D55FB5-8ED8-4797-B5BC-545477AF7347\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:flexcube_universal_banking:14.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"93B0DE54-8EFB-4B79-B423-215D64E89097\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad en el componente Oracle Banking Corporate Lending de Oracle Financial Services Applications (subcomponente: Core module). Las versiones soportadas que se han visto afectadas son la 12.3.0, 12.4.0, 12.5.0 y la 14.0.0. Una vulnerabilidad f\\u00e1cilmente explotable permite que un atacante con un bajo nivel de privilegios que tenga acceso a red por HTTP comprometa la seguridad de Oracle Banking Corporate Lending. Los ataques exitosos a esta vulnerabilidad pueden resultar en un acceso no autorizado a datos de suma importancia o un acceso completo a todos los datos accesibles de Oracle Banking Corporate Lending. CVSS 3.0 Base Score 6.5 (impactos en la confidencialidad). Vector CVSS: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).\"}]",
      "id": "CVE-2018-2747",
      "lastModified": "2024-11-21T04:04:21.833",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:N/A:N\", \"baseScore\": 4.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2018-04-19T02:29:01.007",
      "references": "[{\"url\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/103844\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securitytracker.com/id/1040693\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/103844\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securitytracker.com/id/1040693\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
      "sourceIdentifier": "secalert_us@oracle.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-2747\",\"sourceIdentifier\":\"secalert_us@oracle.com\",\"published\":\"2018-04-19T02:29:01.007\",\"lastModified\":\"2024-11-21T04:04:21.833\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad en el componente Oracle Banking Corporate Lending de Oracle Financial Services Applications (subcomponente: Core module). Las versiones soportadas que se han visto afectadas son la 12.3.0, 12.4.0, 12.5.0 y la 14.0.0. Una vulnerabilidad f\u00e1cilmente explotable permite que un atacante con un bajo nivel de privilegios que tenga acceso a red por HTTP comprometa la seguridad de Oracle Banking Corporate Lending. Los ataques exitosos a esta vulnerabilidad pueden resultar en un acceso no autorizado a datos de suma importancia o un acceso completo a todos los datos accesibles de Oracle Banking Corporate Lending. CVSS 3.0 Base Score 6.5 (impactos en la confidencialidad). Vector CVSS: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_corporate_lending:12.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"38C8F66A-D6CC-4B59-B2FC-299A4332360F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_corporate_lending:12.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AB5104F-057C-4887-BEAF-7A59D11DFB23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_corporate_lending:12.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6A9144-B6C5-482B-B91E-58BC196FFA68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_corporate_lending:14.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A29D91D2-687E-4671-88DC-9D36BB5EDAB7\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_payments:12.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5723C585-7087-46F1-949C-FED9A56A386A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_payments:12.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ADFA6852-C1B5-4778-A238-40A8FAB46DD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_payments:12.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF33F6D1-56E6-414A-B0FB-B09A2E6154AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_payments:14.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BE6EB99-98BF-49A2-8890-829320607A1B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_enterprise_limits_and_collateral_management:12.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90447192-DB29-41D5-AF1F-0364A2893ED4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_enterprise_limits_and_collateral_management:14.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D061FB7-A8B4-4D2C-BB76-38B977F1A12B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0A34DF8-72CC-4A8E-84F2-C2DF4A0B9FAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"21BE77B2-6368-470E-B9E6-21664D9A818A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3250073F-325A-4AFC-892F-F2005E3854A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0DDDC9C2-33D6-4123-9ABC-C9B809A6E88E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_universal_banking:11.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDAB2438-6836-4632-A344-3486F0661D17\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_universal_banking:11.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4703D070-2171-4501-9EF1-A417AB111D95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_universal_banking:12.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"501D0455-4A7E-496A-9D92-CD2A0E9ECC62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_universal_banking:12.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"097B84AB-C16F-48B4-BFCE-DB87D607EC5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_universal_banking:12.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"77C313ED-A2A5-4BD2-B88F-F8F5DA2DAFAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_universal_banking:12.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E9EF4050-D40E-4D2E-91B9-5387B2464208\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_universal_banking:12.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CA52AE9-989E-40B4-A9CF-9E45EABEB54B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_universal_banking:12.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"77DAFCA5-2BAD-4382-8AEB-862E10B87161\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3D55FB5-8ED8-4797-B5BC-545477AF7347\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:flexcube_universal_banking:14.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"93B0DE54-8EFB-4B79-B423-215D64E89097\"}]}]}],\"references\":[{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/103844\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1040693\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/103844\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1040693\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"product\": \"FLEXCUBE Universal Banking\", \"vendor\": \"Oracle Corporation\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.3.0\"}, {\"status\": \"affected\", \"version\": \"11.4.0\"}, {\"status\": \"affected\", \"version\": \"12.0.1\"}, {\"status\": \"affected\", \"version\": \"12.0.2\"}, {\"status\": \"affected\", \"version\": \"12.0.3\"}, {\"status\": \"affected\", \"version\": \"12.1.0\"}, {\"status\": \"affected\", \"version\": \"12.2.0\"}, {\"status\": \"affected\", \"version\": \"12.3.0\"}, {\"status\": \"affected\", \"version\": \"12.4.0\"}, {\"status\": \"affected\", \"version\": \"14.0.0\"}]}], \"datePublic\": \"2018-03-27T00:00:00\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data.\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2018-04-19T09:57:01\", \"orgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"shortName\": \"oracle\"}, \"references\": [{\"name\": \"1040693\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\"], \"url\": \"http://www.securitytracker.com/id/1040693\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html\"}, {\"name\": \"103844\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"], \"url\": \"http://www.securityfocus.com/bid/103844\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"secalert_us@oracle.com\", \"ID\": \"CVE-2018-2747\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"FLEXCUBE Universal Banking\", \"version\": {\"version_data\": [{\"version_affected\": \"=\", \"version_value\": \"11.3.0\"}, {\"version_affected\": \"=\", \"version_value\": \"11.4.0\"}, {\"version_affected\": \"=\", \"version_value\": \"12.0.1\"}, {\"version_affected\": \"=\", \"version_value\": \"12.0.2\"}, {\"version_affected\": \"=\", \"version_value\": \"12.0.3\"}, {\"version_affected\": \"=\", \"version_value\": \"12.1.0\"}, {\"version_affected\": \"=\", \"version_value\": \"12.2.0\"}, {\"version_affected\": \"=\", \"version_value\": \"12.3.0\"}, {\"version_affected\": \"=\", \"version_value\": \"12.4.0\"}, {\"version_affected\": \"=\", \"version_value\": \"14.0.0\"}]}}]}, \"vendor_name\": \"Oracle Corporation\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data.\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"1040693\", \"refsource\": \"SECTRACK\", \"url\": \"http://www.securitytracker.com/id/1040693\"}, {\"name\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html\", \"refsource\": \"CONFIRM\", \"url\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html\"}, {\"name\": \"103844\", \"refsource\": \"BID\", \"url\": \"http://www.securityfocus.com/bid/103844\"}]}}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-05T04:29:44.446Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"name\": \"1040693\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\", \"x_transferred\"], \"url\": \"http://www.securitytracker.com/id/1040693\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html\"}, {\"name\": \"103844\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"], \"url\": \"http://www.securityfocus.com/bid/103844\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2018-2747\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-03T19:24:58.517296Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-03T19:25:37.435Z\"}}]}",
      "cveMetadata": "{\"assignerOrgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"assignerShortName\": \"oracle\", \"cveId\": \"CVE-2018-2747\", \"datePublished\": \"2018-04-19T02:00:00\", \"dateReserved\": \"2017-12-15T00:00:00\", \"dateUpdated\": \"2024-10-03T20:23:07.974Z\", \"state\": \"PUBLISHED\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2018-2747

Vulnerability from fkie_nvd - Published: 2018-04-19 02:29 - Updated: 2024-11-21 04:04

Severity ?

6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
secalert_us@oracle.com	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	Patch, Vendor Advisory
secalert_us@oracle.com	http://www.securityfocus.com/bid/103844	Third Party Advisory, VDB Entry
secalert_us@oracle.com	http://www.securitytracker.com/id/1040693	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/103844	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id/1040693	Third Party Advisory, VDB Entry

Impacted products

Vendor	Product	Version
oracle	banking_corporate_lending	12.3.0
oracle	banking_corporate_lending	12.4.0
oracle	banking_corporate_lending	12.5.0
oracle	banking_corporate_lending	14.0.0
oracle	banking_payments	12.3.0
oracle	banking_payments	12.4.0
oracle	banking_payments	12.5.0
oracle	banking_payments	14.0.0
oracle	flexcube_enterprise_limits_and_collateral_management	12.3.0
oracle	flexcube_enterprise_limits_and_collateral_management	14.0.0
oracle	flexcube_investor_servicing	12.0.4
oracle	flexcube_investor_servicing	12.1.0
oracle	flexcube_investor_servicing	12.3.0
oracle	flexcube_investor_servicing	12.4.0
oracle	flexcube_universal_banking	11.3.0
oracle	flexcube_universal_banking	11.4.0
oracle	flexcube_universal_banking	12.0.1
oracle	flexcube_universal_banking	12.0.2
oracle	flexcube_universal_banking	12.0.3
oracle	flexcube_universal_banking	12.1.0
oracle	flexcube_universal_banking	12.2.0
oracle	flexcube_universal_banking	12.3.0
oracle	flexcube_universal_banking	12.4.0
oracle	flexcube_universal_banking	14.0.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:banking_corporate_lending:12.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "38C8F66A-D6CC-4B59-B2FC-299A4332360F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_corporate_lending:12.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3AB5104F-057C-4887-BEAF-7A59D11DFB23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_corporate_lending:12.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F6A9144-B6C5-482B-B91E-58BC196FFA68",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_corporate_lending:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A29D91D2-687E-4671-88DC-9D36BB5EDAB7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:banking_payments:12.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5723C585-7087-46F1-949C-FED9A56A386A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_payments:12.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "ADFA6852-C1B5-4778-A238-40A8FAB46DD5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_payments:12.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF33F6D1-56E6-414A-B0FB-B09A2E6154AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_payments:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BE6EB99-98BF-49A2-8890-829320607A1B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_enterprise_limits_and_collateral_management:12.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "90447192-DB29-41D5-AF1F-0364A2893ED4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_enterprise_limits_and_collateral_management:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D061FB7-A8B4-4D2C-BB76-38B977F1A12B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0A34DF8-72CC-4A8E-84F2-C2DF4A0B9FAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "21BE77B2-6368-470E-B9E6-21664D9A818A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3250073F-325A-4AFC-892F-F2005E3854A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DDDC9C2-33D6-4123-9ABC-C9B809A6E88E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:11.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDAB2438-6836-4632-A344-3486F0661D17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:11.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4703D070-2171-4501-9EF1-A417AB111D95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "501D0455-4A7E-496A-9D92-CD2A0E9ECC62",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "097B84AB-C16F-48B4-BFCE-DB87D607EC5C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "77C313ED-A2A5-4BD2-B88F-F8F5DA2DAFAF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E9EF4050-D40E-4D2E-91B9-5387B2464208",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0CA52AE9-989E-40B4-A9CF-9E45EABEB54B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "77DAFCA5-2BAD-4382-8AEB-862E10B87161",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3D55FB5-8ED8-4797-B5BC-545477AF7347",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "93B0DE54-8EFB-4B79-B423-215D64E89097",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el componente Oracle Banking Corporate Lending de Oracle Financial Services Applications (subcomponente: Core module). Las versiones soportadas que se han visto afectadas son la 12.3.0, 12.4.0, 12.5.0 y la 14.0.0. Una vulnerabilidad f\u00e1cilmente explotable permite que un atacante con un bajo nivel de privilegios que tenga acceso a red por HTTP comprometa la seguridad de Oracle Banking Corporate Lending. Los ataques exitosos a esta vulnerabilidad pueden resultar en un acceso no autorizado a datos de suma importancia o un acceso completo a todos los datos accesibles de Oracle Banking Corporate Lending. CVSS 3.0 Base Score 6.5 (impactos en la confidencialidad). Vector CVSS: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."
    }
  ],
  "id": "CVE-2018-2747",
  "lastModified": "2024-11-21T04:04:21.833",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-04-19T02:29:01.007",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/103844"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1040693"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/103844"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1040693"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GSD-2018-2747

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2018-2747

Aliases

CVE-2018-2747

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-2747",
    "description": "Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).",
    "id": "GSD-2018-2747"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-2747"
      ],
      "details": "Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).",
      "id": "GSD-2018-2747",
      "modified": "2023-12-13T01:22:31.901698Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert_us@oracle.com",
        "ID": "CVE-2018-2747",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "FLEXCUBE Universal Banking",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "11.3.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.4.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.1.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.2.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.3.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.4.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.0.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Oracle Corporation"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data."
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "1040693",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1040693"
          },
          {
            "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
          },
          {
            "name": "103844",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/103844"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_corporate_lending:12.5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_corporate_lending:14.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_corporate_lending:12.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_corporate_lending:12.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_payments:12.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_payments:12.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_payments:14.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:banking_payments:12.5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_enterprise_limits_and_collateral_management:12.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_enterprise_limits_and_collateral_management:14.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_universal_banking:11.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_universal_banking:11.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_universal_banking:12.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_universal_banking:12.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_universal_banking:12.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_universal_banking:14.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_universal_banking:12.2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_universal_banking:12.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:flexcube_universal_banking:12.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2018-2747"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
            },
            {
              "name": "1040693",
              "refsource": "SECTRACK",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securitytracker.com/id/1040693"
            },
            {
              "name": "103844",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/103844"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2019-10-03T00:03Z",
      "publishedDate": "2018-04-19T02:29Z"
    }
  }
}

CNVD-2018-09099

Vulnerability from cnvd - Published: 2018-05-08

Title

Oracle Banking Corporate Lending组件远程漏洞（CNVD-2018-09099）

Description

Oracle Financial Services Applications是美国甲骨文（Oracle）公司的一套集核心银行、网上银行和财产管理于一身的金融服务软件。Banking Corporate Lending是其中的一个银行贷款管理组件。 Oracle Financial Services Applications中的Banking Corporate Lending组件的Core module子组件存在安全漏洞。攻击者可利用该漏洞未授权访问数据，影响数据的保密性。

Severity

中

Patch Name

Oracle Banking Corporate Lending组件远程漏洞（CNVD-2018-09099）的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Reference

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Impacted products

Name
['Oracle Banking Corporate Lending 12.3.0', 'Oracle Banking Corporate Lending 12.4.0', 'Oracle Banking Corporate Lending 12.5.0', 'Oracle Banking Corporate Lending 14.0.0']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "103844"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-2747",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2747"
    }
  },
  "description": "Oracle Financial Services Applications\u662f\u7f8e\u56fd\u7532\u9aa8\u6587\uff08Oracle\uff09\u516c\u53f8\u7684\u4e00\u5957\u96c6\u6838\u5fc3\u94f6\u884c\u3001\u7f51\u4e0a\u94f6\u884c\u548c\u8d22\u4ea7\u7ba1\u7406\u4e8e\u4e00\u8eab\u7684\u91d1\u878d\u670d\u52a1\u8f6f\u4ef6\u3002Banking Corporate Lending\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u94f6\u884c\u8d37\u6b3e\u7ba1\u7406\u7ec4\u4ef6\u3002\r\n\r\nOracle Financial Services Applications\u4e2d\u7684Banking Corporate Lending\u7ec4\u4ef6\u7684Core module\u5b50\u7ec4\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u672a\u6388\u6743\u8bbf\u95ee\u6570\u636e\uff0c\u5f71\u54cd\u6570\u636e\u7684\u4fdd\u5bc6\u6027\u3002",
  "discovererName": "Oracle",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-09099",
  "openTime": "2018-05-08",
  "patchDescription": "Oracle Financial Services Applications\u662f\u7f8e\u56fd\u7532\u9aa8\u6587\uff08Oracle\uff09\u516c\u53f8\u7684\u4e00\u5957\u96c6\u6838\u5fc3\u94f6\u884c\u3001\u7f51\u4e0a\u94f6\u884c\u548c\u8d22\u4ea7\u7ba1\u7406\u4e8e\u4e00\u8eab\u7684\u91d1\u878d\u670d\u52a1\u8f6f\u4ef6\u3002Banking Corporate Lending\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u94f6\u884c\u8d37\u6b3e\u7ba1\u7406\u7ec4\u4ef6\u3002\r\n\r\nOracle Financial Services Applications\u4e2d\u7684Banking Corporate Lending\u7ec4\u4ef6\u7684Core module\u5b50\u7ec4\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u672a\u6388\u6743\u8bbf\u95ee\u6570\u636e\uff0c\u5f71\u54cd\u6570\u636e\u7684\u4fdd\u5bc6\u6027\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Oracle Banking Corporate Lending\u7ec4\u4ef6\u8fdc\u7a0b\u6f0f\u6d1e\uff08CNVD-2018-09099\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Oracle Banking Corporate Lending 12.3.0",
      "Oracle Banking Corporate Lending 12.4.0",
      "Oracle Banking Corporate Lending 12.5.0",
      "Oracle Banking Corporate Lending 14.0.0"
    ]
  },
  "referenceLink": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
  "serverity": "\u4e2d",
  "submitTime": "2018-04-27",
  "title": "Oracle Banking Corporate Lending\u7ec4\u4ef6\u8fdc\u7a0b\u6f0f\u6d1e\uff08CNVD-2018-09099\uff09"
}

GHSA-J3PG-XCG8-6MJJ

Vulnerability from github – Published: 2022-05-13 01:51 – Updated: 2022-05-13 01:51

Details

Severity ?

6.5 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-2747"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-19T02:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications (subcomponent: Core module). Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0 and 14.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Corporate Lending. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Corporate Lending accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).",
  "id": "GHSA-j3pg-xcg8-6mjj",
  "modified": "2022-05-13T01:51:31Z",
  "published": "2022-05-13T01:51:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2747"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/103844"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1040693"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2018-2747 (GCVE-0-2018-2747)

FKIE_CVE-2018-2747

GSD-2018-2747

CNVD-2018-09099

GHSA-J3PG-XCG8-6MJJ

Tags

Sightings

Nomenclature