Oracle FLEXCUBE Universal Banking up to 12.0.3/12.4.0/14.2.0 jackson-databind access control

Summaryinfo

A vulnerability was found in Oracle FLEXCUBE Universal Banking up to 12.0.3/12.4.0/14.2.0. It has been classified as critical. Impacted is an unknown function of the component jackson-databind. This manipulation causes access control. The identification of this vulnerability is CVE-2019-2794. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in Oracle FLEXCUBE Universal Banking up to 12.0.3/12.4.0/14.2.0 (Banking Software). Affected by this vulnerability is an unknown code block of the component jackson-databind. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality. The summary by CVE is:

Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.0.1-12.0.3, 12.1.0-12.4.0 and 14.0.0-14.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

The weakness was shared 07/16/2019 as Oracle Critical Patch Update Advisory - Juli 2019 as confirmed advisory (Website). The advisory is shared at oracle.com. This vulnerability is known as CVE-2019-2794 since 12/14/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The entries VDB-137972, VDB-137963, VDB-137964 and VDB-137965 are related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Banking Software

Vendor

• Oracle

Name

• FLEXCUBE Universal Banking

Version

• 12.0
• 12.0.0
• 12.0.1
• 12.0.2
• 12.0.3
• 12.1
• 12.2
• 12.3
• 12.4.0
• 14.0
• 14.1
• 14.2.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion