CVE-2018-2702: Medium severity oracle peoplesoft enterprise scm vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Strategic Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Affected Software

1 affected component

Oracle PeopleSoft Enterprise SCM Strategic Sourcing=9.2

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2702?

CVE-2018-2702 is considered to be easily exploitable, allowing low privileged attackers to compromise the affected system.

How do I fix CVE-2018-2702?

To fix CVE-2018-2702, it is recommended to apply the latest patches provided by Oracle for PeopleSoft Enterprise 9.2.

What components are affected by CVE-2018-2702?

CVE-2018-2702 affects the PeopleSoft Enterprise FSCM component, specifically the Strategic Sourcing subcomponent.

Can a low privileged attacker exploit CVE-2018-2702 remotely?

Yes, CVE-2018-2702 can be exploited by a low privileged attacker with network access via HTTP.

Is there an official advisory for CVE-2018-2702?

Yes, Oracle has released a security advisory that addresses CVE-2018-2702 and provides guidance on mitigation.