{"containers": {"cna": {"affected": [{"product": "FLEXCUBE Universal Banking", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "11.3.0"}, {"status": "affected", "version": "11.4.0"}, {"status": "affected", "version": "12.0.1"}, {"status": "affected", "version": "12.0.2"}, {"status": "affected", "version": "12.0.3"}, {"status": "affected", "version": "12.1.0"}, {"status": "affected", "version": "12.2.0"}, {"status": "affected", "version": "12.3.0"}, {"status": "affected", "version": "12.4.0"}]}], "datePublic": "2018-01-03T00:00:00", "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)."}], "problemTypes": [{"descriptions": [{"description": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle FLEXCUBE Universal Banking.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-18T10:57:01", "orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"}, {"name": "1040214", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1040214"}, {"name": "102582", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/102582"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2018-2649", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "FLEXCUBE Universal Banking", "version": {"version_data": [{"version_affected": "=", "version_value": "11.3.0"}, {"version_affected": "=", "version_value": "11.4.0"}, {"version_affected": "=", "version_value": "12.0.1"}, {"version_affected": "=", "version_value": "12.0.2"}, {"version_affected": "=", "version_value": "12.0.3"}, {"version_affected": "=", "version_value": "12.1.0"}, {"version_affected": "=", "version_value": "12.2.0"}, {"version_affected": "=", "version_value": "12.3.0"}, {"version_affected": "=", "version_value": "12.4.0"}]}}]}, "vendor_name": "Oracle Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle FLEXCUBE Universal Banking."}]}]}, "references": {"reference_data": [{"name": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"}, {"name": "1040214", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1040214"}, {"name": "102582", "refsource": "BID", "url": "http://www.securityfocus.com/bid/102582"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T04:21:34.424Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"}, {"name": "1040214", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1040214"}, {"name": "102582", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/102582"}]}]}, "cveMetadata": {"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "assignerShortName": "oracle", "cveId": "CVE-2018-2649", "datePublished": "2018-01-18T02:00:00", "dateReserved": "2017-12-15T00:00:00", "dateUpdated": "2024-08-05T04:21:34.424Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:11.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "BDAB2438-6836-4632-A344-3486F0661D17", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:11.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "4703D070-2171-4501-9EF1-A417AB111D95", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "501D0455-4A7E-496A-9D92-CD2A0E9ECC62", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "097B84AB-C16F-48B4-BFCE-DB87D607EC5C", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "77C313ED-A2A5-4BD2-B88F-F8F5DA2DAFAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "E9EF4050-D40E-4D2E-91B9-5387B2464208", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "0CA52AE9-989E-40B4-A9CF-9E45EABEB54B", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "77DAFCA5-2BAD-4382-8AEB-862E10B87161", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "F3D55FB5-8ED8-4797-B5BC-545477AF7347", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0 and 12.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el componente Oracle FLEXCUBE Universal Banking de Oracle Financial Services Applications (subcomponente: Infrastructure). Las versiones compatibles que se han visto afectadas son la 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0 y la 12.4.0. Una vulnerabilidad f\u00e1cilmente explotable permite que un atacante con pocos privilegios que tenga acceso a red por HTTP comprometa la seguridad de Oracle FLEXCUBE Universal Banking. Los ataques exitosos a esta vulnerabilidad pueden resultar en la creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n de acceso no autorizado a datos cr\u00edticos o a todos los datos accesibles de Oracle FLEXCUBE Universal Banking, as\u00ed como la capacidad no autorizada de provocar un bloqueo o un cierre inesperado, con frecuencia y de manera repetida (DOS completo) de Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 8.1 (impactos en la integridad y disponibilidad). Vector CVSS: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)"}], "id": "CVE-2018-2649", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-18T02:29:21.337", "references": [{"source": "secalert_us@oracle.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"}, {"source": "secalert_us@oracle.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/102582"}, {"source": "secalert_us@oracle.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1040214"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}