CVE-2019-2605

Опубликовано: 23 апр. 2019

Источник: nvd

CVSS3: 3.4

CVSS2: 2.6

EPSS Низкий

Описание

Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Web Catalog). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).

Ссылки

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Patch
Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:oracle:business_intelligence:11.1.1.9.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*

EPSS

Процентиль: 73%

0.00755

Низкий

3.4 Low

CVSS3

2.6 Low

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-pvp6-8jxg-p694

github

больше 3 лет назад

BDU:2019-01611