CVE-2019-2406: High severity ibm security identity manager vulnerability
An unspecified vulnerability in Oracle Database Server related to the Core RDBMS component could allow an authenticated attacker to take control of the system.
Other sources
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. Successful attacks of this vulnerability can result in takeover of Core RDBMS. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-2406?
CVE-2019-2406 is an unspecified vulnerability in the Core RDBMS component of Oracle Database Server.
Which versions of Oracle Database Server are affected by CVE-2019-2406?
Oracle Database Server versions 12.1.0.2, 12.2.0.1, and 18c are affected by CVE-2019-2406.
How severe is CVE-2019-2406?
CVE-2019-2406 has a severity rating of 7.2 (high).
How can CVE-2019-2406 be exploited?
CVE-2019-2406 can be easily exploited by a high privileged attacker with Create Session and Execute Catalog Role privilege via Oracle Net with network access.
Are there any references related to CVE-2019-2406?
Yes, you can find more information about CVE-2019-2406 at the following references: [1] http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html, [2] http://www.securityfocus.com/bid/106591, [3] https://exchange.xforce.ibmcloud.com/vulnerabilities/155725