CVE-2019-2629: Vulnerability in the Oracle Health Sciences Data Management Workbench component of Oracle Health Sciences Applications (subcomponent: User Interface)

Medium severity · published Apr 23, 2019

CVE-2019-2629

Vulnerability in the Oracle Health Sciences Data Management Workbench component of Oracle Health Sciences Applications (subcomponent: User Interface)

5.4

CVSS

0.8%

EPSS

On KEV

Description

Vulnerability in the Oracle Health Sciences Data Management Workbench component of Oracle Health Sciences Applications (subcomponent: User Interface). The supported version that is affected is 2.4.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Health Sciences Data Management Workbench. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Health Sciences Data Management Workbench accessible data as well as unauthorized read access to a subset of Oracle Health Sciences Data Management Workbench accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 55% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Health Sciences Data Management Workbench · Oracle

2.4.8 · source: NVD

Affected product

Health Sciences Data Management Workbench

Oracle

All Health Sciences Data Management Workbench CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-2629

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-2629

Patch

http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

More from Health Sciences Data Management Workbench

9.8

CVE-2019-2904

Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces)

7.2

CVE-2021-23337

Command Injection

6.6

CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses…

6.5

CVE-2022-21518

Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: User Interface)

5.3

CVE-2020-28500

Regular Expression Denial of Service (ReDoS)