CVE-2018-3167

EPSS 17.1%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS —EPSS 17.1%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

17 Oct 2018Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monitoring). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Management Pack for Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Application Management Pack for Oracle E-Business Suite accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected products

Oracle Corporation · Application Management Pack for Oracle E-Business Suite

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.securityfocus.com/bid/105627 http://www.securitytracker.com/id/1041897