Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-3160: Oracle Hospitality Cruise system can be taken over

CVE-2018-3160 · published 8 years ago

Summary

The Oracle Hospitality Cruise Shipboard Property Management System (version 8.0) can be hijacked by an attacker who already has a high‑level login on the same network. This could let the attacker control the system and affect related hotel‑management tools. Apply the latest security update from Oracle and limit network access to trusted administrators only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	hospitality_cruise_shipboard_property_management_system	8.0 `cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:8.0:::::::*`

Original advisory text

Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: OHC Admin, OHC Management). The supported version that is affected is 8.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hospitality Cruise Shipboard Property Management System executes to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality Cruise Shipboard Property Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Cruise Shipboard Property Management System. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H).

References

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch Vendor Advisory
http://www.securityfocus.com/bid/105632 Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.7 High

Exploitation

<1% chance of attack within 30 days

Timeline

Published17 Oct 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-3160 · NVD

Track software like this

Free during beta