CVE-2018-2635
First published: Thu Jan 18 2018(Updated: )
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Login). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle E-Business Suite | =12.1.3 | |
| Oracle E-Business Suite | =12.2.3 | |
| Oracle E-Business Suite | =12.2.4 | |
| Oracle E-Business Suite | =12.2.5 | |
| Oracle E-Business Suite | =12.2.6 | |
| Oracle E-Business Suite | =12.2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-2635?
CVE-2018-2635 is a vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite.
What versions of Oracle E-Business Suite are affected by CVE-2018-2635?
Oracle E-Business Suite versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7 are affected by CVE-2018-2635.
What is the severity rating of CVE-2018-2635?
CVE-2018-2635 has a severity rating of 4.8, which is considered medium.
How can an attacker exploit CVE-2018-2635?
An unauthenticated attacker can exploit CVE-2018-2635 with network access via HTTP to compromise the Oracle E-Business Suite component.
Where can I find more information about CVE-2018-2635?
You can find more information about CVE-2018-2635 at the following references: [Oracle Security Advisory](http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html), [SecurityFocus](http://www.securityfocus.com/bid/102652), [SecurityTracker](http://www.securitytracker.com/id/1040201).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/severity
- agent/references
- agent/author
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/oracle
- canonical/oracle e-business suite
- version/oracle e-business suite/12.1.3
- version/oracle e-business suite/12.2.3
- version/oracle e-business suite/12.2.4
- version/oracle e-business suite/12.2.5
- version/oracle e-business suite/12.2.6
- version/oracle e-business suite/12.2.7