CVE-2019-2638
First published: Tue Apr 23 2019(Updated: )
Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Consolidation Hierarchy Viewer). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as unauthorized access to critical data or complete access to all Oracle General Ledger accessible data. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).
Credit: secalert_us@oracle.com secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle General Ledger | =12.1.1 | |
| Oracle General Ledger | =12.1.2 | |
| Oracle General Ledger | =12.1.3 | |
| Oracle General Ledger | =12.2.3 | |
| Oracle General Ledger | =12.2.4 | |
| Oracle General Ledger | =12.2.5 | |
| Oracle General Ledger | =12.2.6 | |
| Oracle General Ledger | =12.2.7 | |
| Oracle General Ledger | =12.2.8 | |
| =12.1.1 | ||
| =12.1.2 | ||
| =12.1.3 | ||
| =12.2.3 | ||
| =12.2.4 | ||
| =12.2.5 | ||
| =12.2.6 | ||
| =12.2.7 | ||
| =12.2.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2019-2638?
CVE-2019-2638 is classified as an easily exploitable vulnerability with low privileges required to exploit it.
How do I fix CVE-2019-2638?
To fix CVE-2019-2638, you should apply the latest security patches provided by Oracle for affected versions of the General Ledger component.
Which versions of Oracle General Ledger are affected by CVE-2019-2638?
Affected versions by CVE-2019-2638 include 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, and 12.2.8.
Can CVE-2019-2638 be exploited remotely?
Yes, CVE-2019-2638 can be exploited remotely, making it a significant risk for environments where affected Oracle products are deployed.
What component of Oracle E-Business Suite does CVE-2019-2638 affect?
CVE-2019-2638 affects the Consolidation Hierarchy Viewer component within the Oracle General Ledger.
- collector/nvd-index
- agent/type
- agent/severity
- agent/remedy
- agent/references
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/tags
- agent/source
- vendor/oracle
- canonical/oracle general ledger
- version/oracle general ledger/12.1.1
- version/oracle general ledger/12.1.2
- version/oracle general ledger/12.1.3
- version/oracle general ledger/12.2.3
- version/oracle general ledger/12.2.4
- version/oracle general ledger/12.2.5
- version/oracle general ledger/12.2.6
- version/oracle general ledger/12.2.7
- version/oracle general ledger/12.2.8