CVE-2018-2673: Medium severity oracle hospitality simphony vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: POS). Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected Software

3 affected components

Oracle Hospitality Simphony=2.7

Oracle Hospitality Simphony=2.8

Oracle Hospitality Simphony=2.9

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2673?

The severity of CVE-2018-2673 is medium with a severity value of 5.9.

Which versions of Oracle Hospitality Simphony are affected by CVE-2018-2673?

Oracle Hospitality Simphony versions 2.7, 2.8, and 2.9 are affected by CVE-2018-2673.

What is the subcomponent affected by CVE-2018-2673?

The subcomponent affected by CVE-2018-2673 is POS (Point of Sale).

Is authentication required to exploit CVE-2018-2673?

No, CVE-2018-2673 can be exploited by an unauthenticated attacker with network access via HTTP.

How can an attacker exploit CVE-2018-2673?

An attacker can exploit CVE-2018-2673 by compromising Oracle Hospitality Applications through network access via HTTP.