CVE-2018-2971: Medium severity oracle application development framework vulnerability
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: REST Services). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this Oracle E-Business Suite vulnerability?
The vulnerability ID for this Oracle E-Business Suite vulnerability is CVE-2018-2971.
What is the severity level of CVE-2018-2971?
The severity level of CVE-2018-2971 is medium.
Which versions of Oracle E-Business Suite are affected by this vulnerability?
This vulnerability affects versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7 of Oracle E-Business Suite.
How can this vulnerability be exploited?
This vulnerability can be easily exploited by a low privileged attacker with network access.
Are there any references for this vulnerability?
Yes, you can find more information about this vulnerability at the following references: [1] http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html [2] http://www.securityfocus.com/bid/105620 [3] http://www.securitytracker.com/id/1041897