CVE-2019-2410 in Hospitality Cruise Shipboard Property Management System
Summary
by MITRE
Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: DGS RES Online, FMS Sender, FMS Receiver, OHC WPF Security). The supported version that is affected is 8.0.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality Cruise Shipboard Property Management System executes to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management System accessible data as well as unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 5.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/28/2023
The vulnerability identified as CVE-2019-2410 affects the Oracle Hospitality Cruise Shipboard Property Management System, specifically targeting the DGS RES Online, FMS Sender, FMS Receiver, and OHC WPF Security subcomponents within version 8.0.8. This represents a significant security weakness in hospitality infrastructure systems that serve cruise ship operations, where the attack surface includes critical property management functions. The vulnerability resides within the authentication and authorization mechanisms of the system, creating a pathway for malicious actors who already have network access to the target infrastructure to gain unauthorized access to sensitive operational data.
This flaw constitutes a low complexity, high impact vulnerability that operates with minimal prerequisites for exploitation. The CVSS 3.0 score of 5.1 reflects the system's susceptibility to unauthorized modifications and data access, with the attack vector requiring local network access but no authentication credentials. The vulnerability's classification as easily exploitable indicates that attackers can leverage existing network presence to compromise the system without requiring additional privileged access. The affected components suggest a complex system architecture where multiple communication pathways and security controls have been weakened, creating potential entry points for adversaries seeking to manipulate reservation systems, financial data, and operational records.
The operational impact of this vulnerability extends beyond simple data access, as it enables unauthorized modification of critical systems that manage guest reservations, financial transactions, and shipboard operations. Attackers could potentially insert fraudulent bookings, alter existing reservations, or delete important operational data, leading to significant financial losses and operational disruptions. The confidentiality aspect reveals that unauthorized parties could access sensitive guest information, financial records, and operational details that should remain protected within the cruise ship's management systems. This compromise directly affects the integrity of the reservation and management systems, potentially causing cascading failures in cruise ship operations and guest experience management.
Organizations implementing Oracle Hospitality Cruise Shipboard Property Management Systems should prioritize immediate remediation through official Oracle patches and updates to address this vulnerability. Network segmentation and access controls should be strengthened to limit local network access points, particularly for systems containing sensitive operational data. Regular security assessments of hospitality infrastructure components should be conducted to identify similar vulnerabilities in interconnected systems. The vulnerability aligns with CWE-284, which addresses improper access control issues, and represents a clear violation of the principle of least privilege. From an ATT&CK framework perspective, this vulnerability maps to techniques involving privilege escalation and credential access, where attackers can exploit local network access to gain unauthorized system modifications. Organizations should implement comprehensive monitoring solutions to detect unauthorized access attempts and establish incident response procedures specifically tailored to hospitality system compromises. The vulnerability demonstrates the critical importance of maintaining up-to-date security patches in mission-critical infrastructure systems, particularly those serving high-value operational environments like cruise ship operations.