CVE-2019-2564: Medium severity oracle jd edwards enterpriseone tools vulnerability

Published Apr 23, 2019

Updated

Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Web Runtime). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected Software

1 affected component

ORACLE JD Edwards EnterpriseOne Tools=9.2

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Event History

Apr 23, 2019

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionWeakness

Data Sourced

via NVD·07:32 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-2564?

CVE-2019-2564 is considered a high severity vulnerability due to its ease of exploitation.

How do I fix CVE-2019-2564?

To fix CVE-2019-2564, update your JD Edwards EnterpriseOne Tools to the latest patched version provided by Oracle.

Who is affected by CVE-2019-2564?

CVE-2019-2564 affects users running version 9.2 of Oracle JD Edwards EnterpriseOne Tools.

What type of vulnerability is CVE-2019-2564?

CVE-2019-2564 is a web runtime vulnerability that allows low privileged attackers to compromise the application through HTTP.

Can CVE-2019-2564 be exploited remotely?

Yes, CVE-2019-2564 can be exploited remotely by an attacker with low privileges if they have network access.