ID CVE-2019-2444
Summary Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 18c. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Core RDBMS executes to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Core RDBMS. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:database:12.1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:database:12.1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:database:18c:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:database:18c:*:*:*:*:*:*:*
CVSS
Base: 4.4 (as of 24-08-2020 - 17:37)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:M/Au:N/C:P/I:P/A:P
refmap via4
bid 106584
confirm http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Last major update 24-08-2020 - 17:37
Published 16-01-2019 - 19:30
Last modified 24-08-2020 - 17:37
Back to Top