CVE-2018-2925
First published: Wed Jul 18 2018(Updated: )
Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Server). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Business Intelligence Publisher | =11.1.1.7.0 | |
| Oracle Business Intelligence Publisher | =11.1.1.9.0 | |
| Oracle Business Intelligence Publisher | =12.2.1.2.0 | |
| Oracle Business Intelligence Publisher | =12.2.1.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-2925?
CVE-2018-2925 is a vulnerability in the BI Publisher component of Oracle Fusion Middleware, specifically in the Web Server subcomponent.
Which versions of Oracle Business Intelligence Publisher are affected by CVE-2018-2925?
The affected versions of Oracle Business Intelligence Publisher are 11.1.1.7.0, 11.1.1.9.0, 12.2.1.2.0, and 12.2.1.3.0.
How severe is CVE-2018-2925?
CVE-2018-2925 has a severity rating of 6.5 out of 10, which is considered medium.
How can a low privileged attacker exploit CVE-2018-2925?
A low privileged attacker with network access via HTTP can easily exploit CVE-2018-2925 to compromise the BI Publisher component.
Where can I find more information about CVE-2018-2925?
You can find more information about CVE-2018-2925 on the Oracle Security Advisory and SecurityFocus websites.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/oracle
- canonical/oracle business intelligence publisher
- version/oracle business intelligence publisher/11.1.1.7.0
- version/oracle business intelligence publisher/11.1.1.9.0
- version/oracle business intelligence publisher/12.2.1.2.0
- version/oracle business intelligence publisher/12.2.1.3.0