CVE-2018-2874

low-risk
Published 2018-04-19

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Logging). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows physical access to compromise Oracle Application Object Library. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).

Do I need to act?

-
0.14% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
PHYSICAL / LOW complexity

Affected Products (1)

Affected Vendors

Oracle

References (6)

Patch http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Third Party Advisory http://www.securityfocus.com/bid/103878
Third Party Advisory http://www.securitytracker.com/id/1040694
Patch http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Third Party Advisory http://www.securityfocus.com/bid/103878
Third Party Advisory http://www.securitytracker.com/id/1040694
21
/ 100
low-risk
Severity 15/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal