Medium severity · published Jul 23, 2019
CVE-2019-2753
Vulnerability in the Oracle Text component of Oracle Database Server
4.6
CVSS
0.9%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via OracleNet to compromise Oracle Text. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Text accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Text. CVSS 3.0 Base Score 4.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Database Server · Oracle
11.2.0.4; 12.1.0.2; 12.2.0.1; 18c · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-2753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-2753
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
More from Database Server
10.0
CVE-2020-1953
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements
9.9
CVE-2026-61211
Vulnerability in the RDBMS component of Oracle Database Server
9.9
CVE-2018-3110
A vulnerability was discovered in the Java VM component of Oracle Database Server
9.8
CVE-2019-16942
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10
9.8
CVE-2018-14719
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from…