CVE-2018-2608 is a critical vulnerability affecting Oracle Hospitality Simphony version 2.7, specifically within its Security subcomponent. This easily exploitable flaw allows unauthenticated attackers to gain unauthorized access to critical or all data accessible by Oracle Hospitality Simphony via HTTP network access. The vulnerability carries a high CVSS 3.0 score of 8.6, indicating significant confidentiality impacts, and can affect additional products beyond Simphony itself. Its attack vector is network-based with low attack complexity, requiring no user interaction or privileges. Currently, there is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Despite the lack of current exploitation evidence, its high severity warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.7CPE matchmatch criteria | cpe:2.3:a:oracle:hospitality_simphony:2.7:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.