CVE-2018-2925: Medium severity oracle bi publisher vulnerability

Published Jul 18, 2018

Updated

Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Server). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Affected Software

4 affected components

Oracle Business Intelligence Publisher=11.1.1.7.0

Oracle Business Intelligence Publisher=11.1.1.9.0

Oracle Business Intelligence Publisher=12.2.1.2.0

Oracle Business Intelligence Publisher=12.2.1.3.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Event History

Jul 18, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2018-2925?

CVE-2018-2925 is a vulnerability in the BI Publisher component of Oracle Fusion Middleware, specifically in the Web Server subcomponent.

Which versions of Oracle Business Intelligence Publisher are affected by CVE-2018-2925?

The affected versions of Oracle Business Intelligence Publisher are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.2.0, and 12.2.1.3.0.

How severe is CVE-2018-2925?

CVE-2018-2925 has a severity rating of 6.5 out of 10, which is considered medium.

How can a low privileged attacker exploit CVE-2018-2925?

A low privileged attacker with network access via HTTP can easily exploit CVE-2018-2925 to compromise the BI Publisher component.

Where can I find more information about CVE-2018-2925?

You can find more information about CVE-2018-2925 on the Oracle Security Advisory and SecurityFocus websites.