Medium severity · published Apr 23, 2019
CVE-2019-2713
Vulnerability in the Oracle Commerce Merchandising component of Oracle Commerce (subcomponent: Asset Manager)
6.5
CVSS
1%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Commerce Merchandising component of Oracle Commerce (subcomponent: Asset Manager). The supported version that is affected is 11.2.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Merchandising. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Merchandising accessible data as well as unauthorized read access to a subset of Oracle Commerce Merchandising accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Commerce Merchandising · Oracle
11.2.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-2713
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-2713
Patch
http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
More from Commerce Merchandising
7.5
CVE-2022-24729
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor
6.5
CVE-2021-26272
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space…
6.1
CVE-2020-27193
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and…
5.4
CVE-2022-24728
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor
5.4
CVE-2021-37695
ckeditor is an open source WYSIWYG HTML editor with rich content support