CVE-2018-2861: Medium severity oracle retail back office vulnerability

Published Apr 19, 2018

Updated

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Back Office. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Retail Back Office accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Back Office. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

Affected Software

3 affected components

Oracle Retail Back Office=13.4.9

Oracle Retail Back Office=14.0.4

Oracle Retail Back Office=14.1.3

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Event History

Apr 19, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2861?

The severity of CVE-2018-2861 is medium with a severity value of 6.5.

Which versions of Oracle Retail Back Office are affected by CVE-2018-2861?

The versions 13.4.9, 14.0.4, and 14.1.3 of Oracle Retail Back Office are affected by CVE-2018-2861.

Is CVE-2018-2861 easily exploitable?

Yes, CVE-2018-2861 is easily exploitable.

What is the attack vector for CVE-2018-2861?

The attack vector for CVE-2018-2861 is an unauthenticated attacker with network access via HTTP.

Is there a fix available for CVE-2018-2861?

Please refer to the references provided by Oracle in their security advisory for information on available fixes for CVE-2018-2861.