CVE-2018-2635: Medium severity oracle e-business suite vulnerability
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Login). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-2635?
CVE-2018-2635 is a vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite.
What versions of Oracle E-Business Suite are affected by CVE-2018-2635?
Oracle E-Business Suite versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7 are affected by CVE-2018-2635.
What is the severity rating of CVE-2018-2635?
CVE-2018-2635 has a severity rating of 4.8, which is considered medium.
How can an attacker exploit CVE-2018-2635?
An unauthenticated attacker can exploit CVE-2018-2635 with network access via HTTP to compromise the Oracle E-Business Suite component.
Where can I find more information about CVE-2018-2635?
You can find more information about CVE-2018-2635 at the following references: [Oracle Security Advisory](http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html), [SecurityFocus](http://www.securityfocus.com/bid/102652), [SecurityTracker](http://www.securitytracker.com/id/1040201).