CVE-2019-2682 is a high-severity vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite versions 12.1.3 through 12.2.8, specifically impacting the Attachments/File Upload subcomponent. This easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the framework. Successful attacks, requiring human interaction, can lead to unauthorized access to critical data or complete access to all accessible data, as well as unauthorized data modification. The vulnerability has a CVSS 3.0 Base Score of 8.2 (High), indicating significant confidentiality and integrity impacts. Its attack vector is network-based with low attack complexity, but it requires user interaction. While the vulnerability is in the Oracle Applications Framework, successful attacks may significantly impact additional products. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of CVEs.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
12.1.3CPE matchmatch criteria | cpe:2.3:a:oracle:applications_framework:12.1.3:*:*:*:*:*:*:* | ||
12.2.3CPE matchmatch criteria | cpe:2.3:a:oracle:applications_framework:12.2.3:*:*:*:*:*:*:* | ||
12.2.4CPE matchmatch criteria | cpe:2.3:a:oracle:applications_framework:12.2.4:*:*:*:*:*:*:* | ||
12.2.5CPE matchmatch criteria | cpe:2.3:a:oracle:applications_framework:12.2.5:*:*:*:*:*:*:* | ||
12.2.6CPE matchmatch criteria | cpe:2.3:a:oracle:applications_framework:12.2.6:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.