CVE-2018-2708: Medium severity oracle banking payments vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions that are affected are 12.3.0 and 12.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Payments accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

Affected Software

2 affected components

ORACLE Banking Payments=12.3.0

ORACLE Banking Payments=12.4.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID of the Oracle Banking Payments vulnerability?

The vulnerability ID is CVE-2018-2708.

What software is affected by the Oracle Banking Payments vulnerability?

The affected software is Oracle Banking Payments version 12.3.0 and 12.4.0.

How severe is the Oracle Banking Payments vulnerability?

The severity of the vulnerability is medium with a CVSS score of 5.3.

How can a low privileged attacker exploit the Oracle Banking Payments vulnerability?

A low privileged attacker with network access via HTTP can exploit the vulnerability.

Where can I find more information about the Oracle Banking Payments vulnerability?

You can find more information about the vulnerability on the Oracle website.