CVE-2019-2753: Medium severity oracle database vulnerability

Published Jul 23, 2019

Updated

Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via OracleNet to compromise Oracle Text. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Text accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Text. CVSS 3.0 Base Score 4.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L).

Affected Software

4 affected components

Oracle Database Server=11.2.0.4

Oracle Database Server=12.1.0.2

Oracle Database Server=12.2.0.1

Oracle Database Server=18c

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Event History

Jul 23, 2019

CVE Published

via MITRE·10:31 PM

Data Sourced

via MITRE·10:31 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this Oracle Database Server vulnerability?

The vulnerability ID for this Oracle Database Server vulnerability is CVE-2019-2753.

What is the severity rating of CVE-2019-2753?

The severity rating of CVE-2019-2753 is medium with a score of 4.6.

Which versions of Oracle Database Server are affected by CVE-2019-2753?

The affected versions of Oracle Database Server are 11.2.0.4, 12.1.0.2, 12.2.0.1, and 18c.

How can an attacker exploit CVE-2019-2753?

An attacker with low privileges and Create Session privilege in OracleNet can exploit CVE-2019-2753.

Is there a fix available for CVE-2019-2753?

Yes, Oracle has released a fix for CVE-2019-2753. It is advised to update to the latest patch or version of Oracle Database Server.