CVE-2018-2934: Medium severity oracle e-business suite vulnerability

Published Jul 18, 2018

Updated

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments / File Upload). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected Software

1 affected component

Oracle E-Business Suite=12.1.3

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Event History

Jul 18, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2018-2934.

What is the affected component?

The affected component is the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments / File Upload).

Which version of Oracle E-Business Suite is affected?

The version affected is 12.1.3.

What is the severity of CVE-2018-2934?

The severity of CVE-2018-2934 is medium, with a severity value of 5.3.

How can an attacker exploit CVE-2018-2934?

An unauthenticated attacker with network access via HTTP can easily exploit CVE-2018-2934 to compromise Oracle E-Business Suite.

Where can I find more information about CVE-2018-2934?

More information about CVE-2018-2934 can be found on the Oracle website and security advisory.