CVE-2018-2849 is an easily exploitable vulnerability affecting the Web Access subcomponent of Oracle Primavera P6 Enterprise Project Portfolio Management versions 16.2 and 17.1-17.12. A low-privileged attacker with network access via HTTP can compromise the system. This vulnerability has a CVSS 3.0 Base Score of 7.7 (HIGH), indicating significant confidentiality impacts, potentially leading to unauthorized access to critical or all accessible data. While the vulnerability is not listed in CISA's KEV catalog and has no known public exploits (Metasploit, Nuclei, ExploitDB), its EPSS score is low, and there is no community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 17.1, <= 17.12CPE matchmatch criteria | cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* | ||
16.2CPE matchmatch criteria | cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.