CVE-2018-2954

{"containers": {"cna": {"affected": [{"product": "Order Management", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "12.1.1"}, {"status": "affected", "version": "12.1.2"}, {"status": "affected", "version": "12.1.3"}, {"status": "affected", "version": "12.2.3"}, {"status": "affected", "version": "12.2.4"}, {"status": "affected", "version": "12.2.5"}, {"status": "affected", "version": "12.2.6"}, {"status": "affected", "version": "12.2.7"}]}], "datePublic": "2018-03-27T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tools). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)."}], "problemTypes": [{"descriptions": [{"description": "Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-07-27T09:57:01.000Z", "orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"}, {"name": "104834", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/104834"}, {"name": "1041309", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1041309"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2018-2954", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Order Management", "version": {"version_data": [{"version_affected": "=", "version_value": "12.1.1"}, {"version_affected": "=", "version_value": "12.1.2"}, {"version_affected": "=", "version_value": "12.1.3"}, {"version_affected": "=", "version_value": "12.2.3"}, {"version_affected": "=", "version_value": "12.2.4"}, {"version_affected": "=", "version_value": "12.2.5"}, {"version_affected": "=", "version_value": "12.2.6"}, {"version_affected": "=", "version_value": "12.2.7"}]}}]}, "vendor_name": "Oracle Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tools). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management."}]}]}, "references": {"reference_data": [{"name": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"}, {"name": "104834", "refsource": "BID", "url": "http://www.securityfocus.com/bid/104834"}, {"name": "1041309", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1041309"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T04:36:39.066Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"}, {"name": "104834", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/104834"}, {"name": "1041309", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1041309"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-02T18:16:41.712170Z", "id": "CVE-2018-2954", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T20:14:32.868Z"}}]}, "cveMetadata": {"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "assignerShortName": "oracle", "cveId": "CVE-2018-2954", "datePublished": "2018-07-18T13:00:00.000Z", "dateReserved": "2017-12-15T00:00:00.000Z", "dateUpdated": "2024-10-02T20:14:32.868Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "http://www.securityfocus.com/bid/104834", "name": "104834", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"]}, {"url": "http://www.securitytracker.com/id/1041309", "name": "1041309", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T04:36:39.066Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2018-2954", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-02T18:16:41.712170Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T18:17:22.933Z"}}], "cna": {"affected": [{"vendor": "Oracle Corporation", "product": "Order Management", "versions": [{"status": "affected", "version": "12.1.1"}, {"status": "affected", "version": "12.1.2"}, {"status": "affected", "version": "12.1.3"}, {"status": "affected", "version": "12.2.3"}, {"status": "affected", "version": "12.2.4"}, {"status": "affected", "version": "12.2.5"}, {"status": "affected", "version": "12.2.6"}, {"status": "affected", "version": "12.2.7"}]}], "datePublic": "2018-03-27T00:00:00.000Z", "references": [{"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", "tags": ["x_refsource_CONFIRM"]}, {"url": "http://www.securityfocus.com/bid/104834", "name": "104834", "tags": ["vdb-entry", "x_refsource_BID"]}, {"url": "http://www.securitytracker.com/id/1041309", "name": "1041309", "tags": ["vdb-entry", "x_refsource_SECTRACK"]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tools). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management."}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2018-07-27T09:57:01.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "12.1.1", "version_affected": "="}, {"version_value": "12.1.2", "version_affected": "="}, {"version_value": "12.1.3", "version_affected": "="}, {"version_value": "12.2.3", "version_affected": "="}, {"version_value": "12.2.4", "version_affected": "="}, {"version_value": "12.2.5", "version_affected": "="}, {"version_value": "12.2.6", "version_affected": "="}, {"version_value": "12.2.7", "version_affected": "="}]}, "product_name": "Order Management"}]}, "vendor_name": "Oracle Corporation"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/104834", "name": "104834", "refsource": "BID"}, {"url": "http://www.securitytracker.com/id/1041309", "name": "1041309", "refsource": "SECTRACK"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tools). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management."}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2018-2954", "STATE": "PUBLIC", "ASSIGNER": "secalert_us@oracle.com"}}}}, "cveMetadata": {"cveId": "CVE-2018-2954", "state": "PUBLISHED", "dateUpdated": "2024-10-02T20:14:32.868Z", "dateReserved": "2017-12-15T00:00:00.000Z", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2018-07-18T13:00:00.000Z", "assignerShortName": "oracle"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Order Management", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "12.1.1"}, {"status": "affected", "version": "12.1.2"}, {"status": "affected", "version": "12.1.3"}, {"status": "affected", "version": "12.2.3"}, {"status": "affected", "version": "12.2.4"}, {"status": "affected", "version": "12.2.5"}, {"status": "affected", "version": "12.2.6"}, {"status": "affected", "version": "12.2.7"}]}], "source": "secalert_us@oracle.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:order_management:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "7C890197-8DE6-4F5F-A711-1148779D612A", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:order_management:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "777FF4BF-E290-4EDB-AEF6-2D0AFE4E0FD7", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:order_management:12.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "DAE82704-C50D-4FD7-96EF-85A09239426E", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:order_management:12.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "5FCF902F-8A86-47DC-935F-FE1634F9649C", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:order_management:12.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "49D43985-5019-4154-9FD3-094305B71E5A", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:order_management:12.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "A96732A1-05C9-461B-95AC-7205840CF525", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:order_management:12.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "46779BBB-C23D-44E8-B351-C5553F644666", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:order_management:12.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "3CDB1333-CD13-4B12-B503-3A9A2955B228", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tools). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el componente Oracle Order Management de Oracle E-Business Suite (subcomponente: Product Diagnostic Tools). Las versiones compatibles que se han visto afectadas son la 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 y la 12.2.7. Una vulnerabilidad dif\u00edcilmente explotable permite que un atacante con un bajo nivel de privilegios y con permisos de inicio de sesi\u00f3n en la infraestructura en la que se ejecuta Oracle Order Management comprometa la seguridad de Oracle Order Management. Los ataques exitosos a esta vulnerabilidad pueden resultar en la toma de control de Oracle Order Management. CVSS 3.0 Base Score 7.0 (impactos en la confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)."}], "id": "CVE-2018-2954", "lastModified": "2026-06-17T01:56:41.697", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2018-2954", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-02T18:16:41.712170Z", "version": "2.0.3"}}]}, "published": "2018-07-18T13:29:03.053", "references": [{"source": "secalert_us@oracle.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"}, {"source": "secalert_us@oracle.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/104834"}, {"source": "secalert_us@oracle.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1041309"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/104834"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1041309"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}