ByteOS Network

Vulnerability Details :

CVE-2019-2883

Assigner-oracle

Assigner Org ID-43595867-4340-4103-b7a2-9a5208d29a85

Published At-16 Oct, 2019 | 17:40

Updated At-01 Oct, 2024 | 16:33

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment). The supported version that is affected is 17.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Customer Management and Segmentation Foundation accessible data as well as unauthorized read access to a subset of Oracle Retail Customer Management and Segmentation Foundation accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:oracle

Assigner Org ID:43595867-4340-4103-b7a2-9a5208d29a85

Published At:16 Oct, 2019 | 17:40

Updated At:01 Oct, 2024 | 16:33

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

Oracle Corporation

Product

Retail Customer Management and Segmentation Foundation

Versions

Affected

17.0

Problem Types

Type	CWE ID	Description
text	N/A	Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Customer Management and Segmentation Foundation accessible data as well as unauthorized read access to a subset of Oracle Retail Customer Management and Segmentation Foundation accessible data.

Type: text

CWE ID: N/A

Description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Customer Management and Segmentation Foundation accessible data as well as unauthorized read access to a subset of Oracle Retail Customer Management and Segmentation Foundation accessible data.

References

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	x_refsource_MISC

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	x_refsource_MISC x_transferred

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Resource:

x_refsource_MISC

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:16 Oct, 2019 | 18:15

Updated At:24 Aug, 2020 | 17:37

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.6	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Primary	2.0	4.9	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:N

Type: Primary

Version: 3.1

Base score: 4.6

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.9

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:S/C:P/I:P/A:N

CPE Matches

Oracle Corporation

>>retail_customer_management_and_segmentation_foundation>>17.0

cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	secalert_us@oracle.com	Patch Vendor Advisory

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: secalert_us@oracle.com

Resource:

Patch

Vendor Advisory

Similar CVEs

152Records found

CVE-2017-10370

Matching Score-8

Assigner-Oracle

View Details

Matching Score-8

Assigner-Oracle

CVSS Score-6.9||MEDIUM

EPSS-0.31% / 53.44%

7 Day CHG~0.00%

Published-19 Oct, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Guest Access, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Guest Access accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Guest Access accessible data. CVSS 3.0 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N).

Vendor-Oracle Corporation

Product-hospitality_guest_access Hospitality Guest Access

CVE-2017-10134

Matching Score-8

Assigner-Oracle

View Details

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.42%

7 Day CHG~0.00%

Published-08 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: eProcurement). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise FSCM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FSCM accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Vendor-Oracle Corporation

Product-peoplesoft_enterprise_scm_eprocurement PeopleSoft Enterprise SCM eProcurement

CVE-2019-2883

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs