CVE-2019-2517: Critical severity oracle database vulnerability

Published Apr 23, 2019

Updated

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 18c. Easily exploitable vulnerability allows high privileged attacker having DBFSROLE privilege with network access via Oracle Net to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Core RDBMS. CVSS 3.0 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Affected Software

2 affected components

Oracle Database Server=12.2.0.1

Oracle Database Server=18c

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Event History

Apr 23, 2019

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionWeakness

Data Sourced

via NVD·07:32 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-2517?

CVE-2019-2517 is classified as a high severity vulnerability due to its potential for exploitation by high privileged attackers.

How do I fix CVE-2019-2517?

To remediate CVE-2019-2517, apply the latest security patches released by Oracle for affected versions 12.2.0.1 and 18c.

Who is affected by CVE-2019-2517?

Oracle Database Server versions 12.2.0.1 and 18c that have DBFS_ROLE privilege are affected by CVE-2019-2517.

Can CVE-2019-2517 be easily exploited?

Yes, CVE-2019-2517 is considered easily exploitable if a high privileged attacker has network access.

What component of Oracle is impacted by CVE-2019-2517?

CVE-2019-2517 impacts the Core RDBMS component of the Oracle Database Server.