Work In Process
CVE-2018-2655
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the Oracle Work in Process component of Oracle E-Business Suite (subcomponent: Assemble/Configure to Order). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Work in Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Vulnerability in the Oracle Work in Process component of Oracle E-Business Suite (subcomponent: Assemble/Configure to Order). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
Vulnerability in the Oracle Work in Process component of Oracle E-Business Suite (subcomponent: Assemble/Configure to Order). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Work in Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Affected products include: Oracle Work In Process.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Work In Process
View allVulnerability in the Oracle Work in Process component of Oracle E-Business Suite (subcomponent: Messages). Rated critica
Remote takeover of the Oracle Work in Process (WIP) module of Oracle E-Business Suite (component: Internal Operations) a
Full system takeover of Oracle Work in Process (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable b
Unauthorized data compromise in Oracle Work in Process (a manufacturing module of Oracle E-Business Suite) 12.2.14 throu
Compromise of Oracle Work in Process, a manufacturing module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15
Oracle Work in Process (WIP) versions 12.2.3 through 12.2.15, a manufacturing module within Oracle E-Business Suite, exp
Full takeover of Oracle Work in Process (WIP), a manufacturing execution module in Oracle E-Business Suite, is achievabl
Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5 through 12.2.15 exposes an authorization flaw i
Unauthorized read access to critical data in Oracle Work in Process (E-Business Suite versions 12.2.3-12.2.15) is achiev
Oracle Work in Process within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes low-privileged local attac
Limited local data disclosure in Oracle Work in Process (E-Business Suite component: Internal Operations) versions 12.2.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today