CVE-2018-2730: Medium severity oracle retail merchandising system vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the Oracle Retail Merchandising System component of Oracle Retail Applications (subcomponent: Cross Pillar). The supported version that is affected is 16.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Merchandising System. While the vulnerability is in Oracle Retail Merchandising System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Merchandising System accessible data as well as unauthorized read access to a subset of Oracle Retail Merchandising System accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

Affected Software

1 affected component

Oracle Retail Merchandising System=16.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2730?

CVE-2018-2730 has been rated as easily exploitable, allowing low privileged attackers to compromise the affected system.

How do I fix CVE-2018-2730?

To mitigate CVE-2018-2730, users are advised to apply the latest patches released by Oracle for version 16.0 of the Retail Merchandising System.

Which versions are affected by CVE-2018-2730?

CVE-2018-2730 affects version 16.0 of the Oracle Retail Merchandising System.

What type of attack can exploit CVE-2018-2730?

CVE-2018-2730 can be exploited by low privileged attackers with network access via HTTP.

What component of Oracle Retail Applications does CVE-2018-2730 affect?

CVE-2018-2730 affects the Cross Pillar component of the Oracle Retail Merchandising System.