CVE-2018-2575: Low severity oracle database vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, and 12.2.0.1. Difficult to exploit vulnerability allows high privileged attacker having Local Logon privilege with network access via multiple protocols to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. Note: Applicable only to Windows platform. CVSS 3.0 Base Score 2.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N).

Affected Software

2 affected components

Oracle Database Server=11.2.0.4

Oracle Database Server=12.2.0.1

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2575?

CVE-2018-2575 is classified as a difficult to exploit vulnerability affecting Oracle Database Server.

How do I fix CVE-2018-2575?

To mitigate CVE-2018-2575, apply the latest security patches provided by Oracle for the affected versions.

Which versions of Oracle Database are impacted by CVE-2018-2575?

CVE-2018-2575 affects Oracle Database Server versions 11.2.0.4, 12.1.0.2, and 12.2.0.1.

Who can exploit CVE-2018-2575?

CVE-2018-2575 can potentially be exploited by a high privileged attacker with Local Logon privilege and network access.

What component of Oracle Database is affected by CVE-2018-2575?

CVE-2018-2575 affects the Core RDBMS component of Oracle Database Server.