Applications Framework
CVE-2018-2971
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: REST Services). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: REST Services). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: REST Services). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Affected products include: Oracle Applications Framework.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Applications Framework
View allVulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Home page). Rated crit
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popups). Rated high se
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Rated hi
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Attachments / Fil
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: None). Rated high
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upl
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upl
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: REST Services). Rated
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Session Management). R
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Rated me
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today