VulnerabilityModified

CVE-2018-3167

Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monitoring).

MEDIUM 5.3EPSS 17.1%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 17.1%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monitoring). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Management Pack for Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Application Management Pack for Oracle E-Business Suite accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS 3.0: 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 17.12% probability · 97th percentile
CISA KEV: Not listed
Affected: oracle/application management pack
Source: secalert_us@oracle.com

References

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/105627Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041897Third Party Advisory, VDB Entry
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/105627Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041897Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.