High severity · published Jul 18, 2018
CVE-2018-3002
Vulnerability in the Oracle Hospitality Cruise Fleet Management System component of Oracle Hospitality Applications (subcomponent: Fleet Management System Suite)
7.1
CVSS
0.5%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Hospitality Cruise Fleet Management System component of Oracle Hospitality Applications (subcomponent: Fleet Management System Suite). The supported version that is affected is 9.x. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality Cruise Fleet Management System executes to compromise Oracle Hospitality Cruise Fleet Management System. While the vulnerability is in Oracle Hospitality Cruise Fleet Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Fleet Management System accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HC
Hospitality Cruise Fleet Management · Oracle
9.0 · source: NVD
Affected product
HC
Hospitality Cruise Fleet Management
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3002
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3002
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Third Party Advisory
http://www.securityfocus.com/bid/104811
Third Party Advisory
http://www.securitytracker.com/id/1041300
More from Hospitality Cruise Fleet Management
9.1
CVE-2018-2697
Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System)
8.4
CVE-2017-10398
Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: BaseMasterPage)
8.1
CVE-2018-2984
Vulnerability in the Oracle Hospitality Cruise Fleet Management System component of Oracle Hospitality Applications (subcomponent: Gangway Activity Web App)
7.6
CVE-2018-2701
Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System)
7.5
CVE-2018-2700
Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: Emergency Response System)
