Oracle Database Server Application Express Vulnerability

CVE-2018-2699

Summary

An unauthenticated attacker can exploit a weakness in the Application Express component of Oracle Database Server to achieve unauthorized access. This vulnerability allows the attacker to compromise Application Express with network access through HTTP. Although the vulnerability is contained within Application Express, successful exploitation can lead to significant consequences for other connected products. Attackers may gain unauthorized ability to read, update, insert, or delete data that is accessible through Application Express, especially requiring human interaction from a third party to trigger the attack.

References