Login Request a demo
Medium severity · published Apr 23, 2019
CVE-2019-2576
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Container)
5.3
CVSS
1.5%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Service Bus. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Service Bus · Oracle
11.1.1.9.0; 12.1.3.0.0; 12.2.1.3.0 · source: NVD
Affected product
SB
Service Bus
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-2576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-2576
Patch
http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
More from Service Bus
7.6
CVE-2017-10119
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: OSB Web Console Design, Admin)
7.5
CVE-2024-21246
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality)
7.3
CVE-2019-10086
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property…
7.3
CVE-2017-3507
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Console Design)
6.5
CVE-2024-21205
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality)