CVE-2018-3148: Medium severity oracle unifier vulnerability
Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Supported versions that are affected are 15.1, 15.2, 16.1, 16.2, 17.1-17.12 and 18.1-18.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3148?
CVE-2018-3148 is considered a high severity vulnerability due to its potential for exploitation by unauthenticated attackers.
How do I fix CVE-2018-3148?
To fix CVE-2018-3148, update your Oracle Primavera Unifier to the latest patched version provided by Oracle.
What versions of Oracle Primavera Unifier are affected by CVE-2018-3148?
CVE-2018-3148 affects Oracle Primavera Unifier versions 15.1, 15.2, 16.1, 16.2, and 17.1 through 18.8.
Can CVE-2018-3148 be exploited remotely?
Yes, CVE-2018-3148 allows an unauthenticated remote attacker to exploit the vulnerability if they have network access.
What component of Oracle software does CVE-2018-3148 pertain to?
CVE-2018-3148 pertains to the Web Access component of the Primavera Unifier within the Oracle Construction and Engineering Suite.