CVE-2018-2749

CVE-2018-2749 is a low-privileged vulnerability in the Core module of Oracle Banking Corporate Lending, affecting versions 12.3.0, 12.4.0, 12.5.0, and 14.0.0, as well as several other Oracle Banking and Flexcube products. This easily exploitable flaw allows an attacker with network access via HTTP to compromise the system, requiring user interaction to succeed. Successful exploitation can lead to unauthorized read, update, insert, or delete access to a subset of accessible data within Oracle Banking Corporate Lending, with potential impact on additional products. The vulnerability carries a CVSS 3.0 Base Score of 5.4 (Medium), indicating low confidentiality and integrity impacts. Its attack vector is network-based, with low attack complexity and requiring user interaction. Despite its potential impact, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for CVE-2018-2749 are minimal, with zero mentions or articles, which is typical for a large percentage of CVEs. It is not listed in the CISA Known Exploited Vulnerabilities Catalog or on any hot lists.