CVE-2019-2671 is an easily exploitable vulnerability within the Oracle CRM Technical Foundation, specifically affecting the Preferences subcomponent of Oracle E-Business Suite versions 12.1.3 through 12.2.8. An unauthenticated attacker can exploit this via HTTP, requiring human interaction from a victim. Successful attacks can lead to unauthorized access to critical data, complete access to all accessible data within Oracle CRM Technical Foundation, and unauthorized data modification. This vulnerability carries a CVSS 3.0 Base Score of 8.2 (High), indicating significant confidentiality and integrity impacts. The attack vector is network-based with low attack complexity, but user interaction is required. While the vulnerability is in Oracle CRM Technical Foundation, successful exploitation may impact additional products. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
12.1.3CPE matchmatch criteria | cpe:2.3:a:oracle:crm_technical_foundation:12.1.3:*:*:*:*:*:*:* | ||
12.2.3CPE matchmatch criteria | cpe:2.3:a:oracle:crm_technical_foundation:12.2.3:*:*:*:*:*:*:* | ||
12.2.4CPE matchmatch criteria | cpe:2.3:a:oracle:crm_technical_foundation:12.2.4:*:*:*:*:*:*:* | ||
12.2.5CPE matchmatch criteria | cpe:2.3:a:oracle:crm_technical_foundation:12.2.5:*:*:*:*:*:*:* | ||
12.2.6CPE matchmatch criteria | cpe:2.3:a:oracle:crm_technical_foundation:12.2.6:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.