Unauthorized Data Access Vulnerability in Oracle Demantra Demand Management
CVE-2018-3127

4.3MEDIUM

Key Information:

Vendor
Oracle
Status
Demantra Demand Management
Vendor
CVE Published:
17 October 2018

Summary

A vulnerability exists in the Oracle Demantra Demand Management component that enables an unauthenticated attacker, with network access through HTTP, to manipulate data. This vulnerability facilitates unauthorized updates, inserts, or deletions of data under certain conditions that require user interaction from a third party. The affected versions are 7.3.5 and 12.2, and while it may seem easily exploitable, the requirement for human interaction adds a layer of complexity to successful attempts.

Affected Version(s)

Demantra Demand Management 7.3.5

Demantra Demand Management 12.2

References

http://www.securityfocus.com/bid/105637
vdb-entryx_refsource_BID
http://www.oracle.com/technetwork/security-advisory/cpuoc...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.