Low severity · published Oct 16, 2019
CVE-2019-2899
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM)
2.4
CVSS
0.9%
EPSS
No
On KEV
Description
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM). Supported versions that are affected are 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper and ADF accessible data. CVSS 3.0 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Application Development Framework · Oracle
11.1.1.9.0; 11.1.2.4.0; 12.1.3.0.0; 12.2.1.3.0 · source: NVD
HF
Hyperion Financial Management · Oracle
11.1.2.4 · source: NVD
JD
Jdeveloper · Oracle
11.1.1.9.0; 11.1.2.4.0; 12.1.3.0.0; 12.2.1.3.0 · source: NVD
PE
Peoplesoft Enterprise Scm Purchasing · Oracle
9.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-2899
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-2899
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Patch
https://www.oracle.com/security-alerts/cpuapr2020.html
More from Application Development Framework
9.8
CVE-2022-21445
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
7.8
CVE-2026-35243
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces)
7.2
CVE-2026-46769
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Shared Components)
6.1
CVE-2026-46770
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Security Framework)
4.7
CVE-2026-46772
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces)