CVE-2018-2705: High severity oracle banking payments vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions that are affected are 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks of this vulnerability can result in takeover of Oracle Banking Payments. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Software

2 affected components

ORACLE Banking Payments=12.3.0

ORACLE Banking Payments=12.4.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2705?

The severity of CVE-2018-2705 is high, with a severity value of 8.8.

Which versions of Oracle Banking Payments are affected by CVE-2018-2705?

Versions 12.3.0 and 12.4.0 of Oracle Banking Payments are affected by CVE-2018-2705.

How can an attacker exploit CVE-2018-2705?

An attacker with low privileges and network access via HTTP can easily exploit CVE-2018-2705.

What is the recommended fix for CVE-2018-2705?

Apply the necessary patches or updates provided by Oracle to fix CVE-2018-2705.

Where can I find more information about CVE-2018-2705?

You can find more information about CVE-2018-2705 on the Oracle website, SecurityFocus, and SecurityTracker.