Lucene search

OracleCVE-2018-2632

HistoryJan 18, 2018 - 2:29 a.m.

CVE-2018-2632

2018-01-1802:29:20

oracle

web.nvd.nist.gov

oracle siebel crm

vulnerability

cve-2018-2632

unauthorized access

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

3.5

Confidence

High

EPSS

0.001

Percentile

21.6%

JSON

Vulnerability in the Siebel Engineering - Installer and Deployment component of Oracle Siebel CRM (subcomponent: Siebel Approval Manager). Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Engineering - Installer and Deployment. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel Engineering - Installer and Deployment accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected configurations

Nvd

Vulners

Node

oraclesiebel_engineering-installer_and_deploymentMatch16.0

oraclesiebel_engineering-installer_and_deploymentMatch17.0

VendorProductVersionCPE
oraclesiebel_engineering-installer_and_deployment16.0cpe:2.3:a:oracle:siebel_engineering-installer_and_deployment:16.0:*:*:*:*:*:*:*
oraclesiebel_engineering-installer_and_deployment17.0cpe:2.3:a:oracle:siebel_engineering-installer_and_deployment:17.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	siebel_engineering-installer_and_deployment	16.0	cpe:2.3:a:oracle:siebel_engineering-installer_and_deployment:16.0:::::::*
oracle	siebel_engineering-installer_and_deployment	17.0	cpe:2.3:a:oracle:siebel_engineering-installer_and_deployment:17.0:::::::*

CNA Affected

[
  {
    "product": "Siebel Engineering - Installer and Deployment",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "16.0"
      },
      {
        "status": "affected",
        "version": "17.0"
      }
    ]
  }
]

References

www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

www.securityfocus.com/bid/102631

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

3.5

Confidence

High

EPSS

0.001

Percentile

21.6%

JSON

Related for CVE-2018-2632