CVE-2018-2672: High severity oracle hospitality simphony vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: POS). Supported versions that are affected are 2.7, 2.8 and 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected Software

3 affected components

Oracle Hospitality Simphony=2.7

Oracle Hospitality Simphony=2.8

Oracle Hospitality Simphony=2.9

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2018-2672.

What is the severity of CVE-2018-2672?

The severity of CVE-2018-2672 is high with a severity value of 7.5.

Which component of Oracle Hospitality Applications is affected by CVE-2018-2672?

The Oracle Hospitality Simphony component of Oracle Hospitality Applications is affected by CVE-2018-2672.

Which versions of Oracle Hospitality Simphony are affected by CVE-2018-2672?

Versions 2.7, 2.8, and 2.9 of Oracle Hospitality Simphony are affected by CVE-2018-2672.

Is CVE-2018-2672 easily exploitable?

Yes, CVE-2018-2672 is an easily exploitable vulnerability.