Unauthenticated Network Vulnerability in Oracle Commerce Platform by Oracle
CVE-2019-2659

6.1MEDIUM

Key Information:

Vendor
Oracle
Status
Commerce Platform
Vendor
CVE Published:
23 April 2019

Summary

Oracle Commerce Platform contains a vulnerability in the Dynamo Application Framework that allows unauthenticated attackers with network access via HTTP to compromise the platform's security. Successful exploitation requires human interaction from a non-attacker. The flaw enables attackers to perform unauthorized actions such as update, insert, or delete data, and gain unauthorized read access to certain data within the Oracle Commerce Platform. This vulnerability poses significant risks to the integrity and confidentiality of accessible data.

Affected Version(s)

Commerce Platform 11.2.0.3

References

http://www.oracle.com/technetwork/security-advisory/cpuap...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.