SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2018-3002

Vulnerability in the Oracle Hospitality Cruise Fleet Management System component of Oracle Hospitality Applications (subcomponent: Fleet Management System Suite).

HIGH 7.1EPSS 0.50%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Vulnerability in the Oracle Hospitality Cruise Fleet Management System component of Oracle Hospitality Applications (subcomponent: Fleet Management System Suite). The supported version that is affected is 9.x. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality Cruise Fleet Management System executes to compromise Oracle Hospitality Cruise Fleet Management System. While the vulnerability is in Oracle Hospitality Cruise Fleet Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management System accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

CVSS 3.0
7.1 HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS
0.50% probability · 41th percentile
CISA KEV
Not listed
Affected
oracle/hospitality cruise fleet management
Source
secalert_us@oracle.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.