Lucene search

OracleCVE-2019-2913

HistoryOct 16, 2019 - 6:15 p.m.

CVE-2019-2913

2019-10-1618:15:28

oracle

web.nvd.nist.gov

oracle

database

server

rdbms

vulnerability

exploitable

low privileged

cvss

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

AI Score

4.2

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via OracleNet to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. CVSS 3.0 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).

Affected configurations

Nvd

Vulners

Node

oracledatabase_serverMatch12.2.0.1

oracledatabase_serverMatch18c

oracledatabase_serverMatch19c

VendorProductVersionCPE
oracledatabase_server12.2.0.1cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*
oracledatabase_server18ccpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:*
oracledatabase_server19ccpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	database_server	12.2.0.1	cpe:2.3:a:oracle:database_server:12.2.0.1:::::::*
oracle	database_server	18c	cpe:2.3:a:oracle:database_server:18c:::::::*
oracle	database_server	19c	cpe:2.3:a:oracle:database_server:19c:::::::*

CNA Affected

[
  {
    "product": "Oracle Database",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "12.2.0.1"
      },
      {
        "status": "affected",
        "version": "18c"
      },
      {
        "status": "affected",
        "version": "19c"
      }
    ]
  }
]

References

www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

AI Score

4.2

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2019-2913