CVE-2019-2904

CRITICO 9.8CVE-2019-2904 · Published 16/10/2019 · updated 17/06/2026

In breve

CVE-2019-2904 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda application testing suite (oracle), banking enterprise collections (oracle), banking enterprise originations (oracle).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 14.3%, superiore al 96.6% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
application testing suite oracle	`= 12.5.0.3= 13.1.0.1= 13.2.0.1= 13.3.0.1`	No fix yet
banking enterprise collections oracle	`= 2.7.0= 2.8.0`	No fix yet
banking enterprise originations oracle	`= 2.7.0= 2.8.0`	No fix yet
banking enterprise product manufacturing oracle	`= 2.7.0= 2.8.0`	No fix yet
banking platform oracle	`= 2.4.0= 2.4.1= 2.5.0= 2.6.0= 2.6.1= 2.6.2= 2.7.0= 2.7.1= 2.9.0`	No fix yet
business process management suite oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
clinical oracle	`= 5.2`	No fix yet
communications diameter signaling router oracle	`≥ 8.0.0.0, ≤ 8.4.0.5`	No fix yet
communications network integrity oracle	`≥ 7.3.2, ≤ 7.3.6`	No fix yet
communications service broker oracle	`= 6.0= 6.1`	No fix yet
communications services gatekeeper oracle	`= 6.0= 6.1`	No fix yet
enterprise repository oracle	`= 11.1.1.7.0`	No fix yet
financial services lending and leasing oracle	`= 12.5.0≥ 14.1.0, ≤ 14.2.0`	No fix yet
financial services revenue management and billing analytics oracle	`= 2.6= 2.7= 2.8`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
health sciences data management workbench oracle	`= 2.4= 2.5`	No fix yet
hyperion planning oracle	`= 11.1.2.4`	No fix yet
rapid planning oracle	`= 12.1.3`	No fix yet
retail assortment planning oracle	`= 15.0.3.0= 16.0.3.0`	No fix yet
retail clearance optimization engine oracle	`= 13.4= 14.0.3= 14.0.5`	No fix yet
retail markdown optimization oracle	`= 13.4`	No fix yet
retail sales audit oracle	`= 15.0.3= 16.0.2`	No fix yet

Description

Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

References

oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Patch
oracle.com/security-alerts/cpuapr2020.html · Vendor Advisory
oracle.com/security-alerts/cpuapr2021.html · Vendor Advisory
oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
oracle.com/security-alerts/cpujul2020.html · Vendor Advisory
oracle.com/security-alerts/cpuoct2020.html · Vendor Advisory
zerodayinitiative.com/advisories/ZDI-19-1024 · Third Party Advisory

Altre vulnerabilità di application testing suite

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free