Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-2722: Oracle Price Creation UI lets remote attacker alter data

CVE-2018-2722 · published 8 years ago

Summary

The web interface of Oracle Financial Services Price Creation and Discovery (version 8.0.5) can be accessed without a login and used to change or view information. An attacker only needs a person to click a link for the exploit to work, potentially affecting other related Oracle applications. Apply the latest security update from Oracle as soon as possible and restrict network access to the affected component.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	financial_services_price_creation_and_discovery	8.0.5 `cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.5:::::::*`

Original advisory text

Vulnerability in the Oracle Financial Services Price Creation and Discovery component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Price Creation and Discovery. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Price Creation and Discovery, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Price Creation and Discovery accessible data as well as unauthorized read access to a subset of Oracle Financial Services Price Creation and Discovery accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

References

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch
http://www.securityfocus.com/bid/102673 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040214 Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.1 Medium

Exploitation

1% chance of attack within 30 days

Timeline

Published18 Jan 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-2722 · NVD

Track software like this

Free during beta