CVE-2019-2713: Medium severity oracle commerce vulnerability

Published Apr 23, 2019

Updated

Vulnerability in the Oracle Commerce Merchandising component of Oracle Commerce (subcomponent: Asset Manager). The supported version that is affected is 11.2.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Merchandising. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Merchandising accessible data as well as unauthorized read access to a subset of Oracle Commerce Merchandising accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Affected Software

1 affected component

Oracle Commerce Merchandising=11.2.0.3

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Event History

Apr 23, 2019

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionWeakness

Data Sourced

via NVD·07:32 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID of this vulnerability is CVE-2019-2713.

What component of Oracle Commerce is affected by this vulnerability?

The Oracle Commerce Merchandising component is affected by this vulnerability.

Is this vulnerability easily exploitable?

Yes, this vulnerability is easily exploitable.

What is the severity of this vulnerability?

The severity of this vulnerability is medium.

How can an attacker exploit this vulnerability?

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Commerce Merchandising.