Order Management
CVE-2018-2954
HIGH
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tools). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tools). Rated high severity (CVSS 7.0).
Technical ContextAI
Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tools). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected products include: Oracle Order Management.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Order Management
View allImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim So
Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagn
Data compromise in Oracle Order Management (Product Diagnostic Tools component) of Oracle E-Business Suite versions 12.2
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tool
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions
Unauthorized data access in Oracle Order Management's Product Diagnostic Tools component allows low-privileged authentic
Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12
Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today