CVE-2019-2905
First published: Wed Oct 16 2019(Updated: )
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Business Intelligence Enterprise Edition | =12.2.1.3.0 | |
| Oracle Business Intelligence Enterprise Edition | =12.2.1.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2019-2905?
CVE-2019-2905 has a critical severity level as it allows unauthenticated network access to the affected Oracle Business Intelligence versions.
How do I fix CVE-2019-2905?
To fix CVE-2019-2905, apply the patches provided by Oracle for the affected versions 12.2.1.3.0 and 12.2.1.4.0.
Which versions are affected by CVE-2019-2905?
CVE-2019-2905 affects Oracle Business Intelligence Enterprise Edition versions 12.2.1.3.0 and 12.2.1.4.0.
Can CVE-2019-2905 be exploited remotely?
Yes, CVE-2019-2905 can be exploited remotely by an unauthenticated attacker with network access via HTTP.
Is there a workaround for CVE-2019-2905?
There are no documented workarounds for CVE-2019-2905, so it is strongly recommended to apply the necessary patches.
- agent/type
- agent/softwarecombine
- agent/references
- agent/author
- agent/remedy
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/oracle business intelligence enterprise edition
- version/oracle business intelligence enterprise edition/12.2.1.3.0
- version/oracle business intelligence enterprise edition/12.2.1.4.0