Oracle MICROS Retail-J 12.1.0/12.1.1/12.1.2/13.1 Internal Operations access control

Summaryinfo

A vulnerability was found in Oracle MICROS Retail-J 12.1.0/12.1.1/12.1.2/13.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Internal Operations. Performing a manipulation results in access control. This vulnerability is reported as CVE-2019-2750. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Oracle MICROS Retail-J 12.1.0/12.1.1/12.1.2/13.1. This affects an unknown function of the component Internal Operations. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications (subcomponent: Internal Operations). Supported versions that are affected are 12.1.0, 12.1.1, 12.1.2 and 13.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MICROS Retail-J accessible data as well as unauthorized update, insert or delete access to some of MICROS Retail-J accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MICROS Retail-J. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).

The weakness was disclosed 07/16/2019 as Oracle Critical Patch Update Advisory - Juli 2019 as confirmed advisory (Website). The advisory is shared at oracle.com. This vulnerability is uniquely identified as CVE-2019-2750 since 12/14/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The entries VDB-137972, VDB-137963, VDB-137964 and VDB-137965 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Oracle

Name

• MICROS Retail-J

Version

• 12.1.0
• 12.1.1
• 12.1.2
• 13.1

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion