ID CVE-2018-2636
Summary Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security). Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:hospitality_simphony:2.7:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:hospitality_simphony:2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:hospitality_simphony:2.8:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:hospitality_simphony:2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:hospitality_simphony:2.9:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:hospitality_simphony:2.9:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
refmap via4
bid 102560
confirm http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
exploit-db 43960
misc
Last major update 03-10-2019 - 00:03
Published 18-01-2018 - 02:29
Back to Top