Micros Lucas
Vendor:
First CVE: Oct 4, 2017 · Active for 8 years
5
Total CVEs
More Total CVEs than 79% of tracked products
1.7
Avg CVEs / Year
Higher CVE frequency than 62% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 63% of tracked products
20.0%
KEV Rate
Higher KEV Rate than 99% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Micros Lucas over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 4, 2017
8 years ago
Most Recent CVE
Apr 23, 2019
2,653 days ago
CVE Severity & Scoring
Micros Lucas5 CVEs
20%
80%
All CVEs353,240 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network5 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low2 (40.0%)
High3 (60.0%)
Unknown0 (0.0%)
User Interaction
None5 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low2 (40.0%)
High0 (0.0%)
None3 (60.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-12617HIGH When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation | Oct 4, 2017 | 8.1 | 99 | YES | YES |
CVE-2018-1258HIGH Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious | May 11, 2018 | 8.8 | 28 | NO | NO |
CVE-2018-11040HIGH Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON wi | Jun 25, 2018 | 7.5 | 25 | NO | NO |
CVE-2018-3120HIGH Vulnerability in the MICROS Lucas component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 2.9.5.6 and 2.9.5.7. Difficult to explo | Apr 23, 2019 | 7.5 | 24 | NO | NO |
CVE-2018-11039MEDIUM Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTT | Jun 25, 2018 | 5.9 | 22 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (5 CVEs).
CISA KEV
1 CVE
20.0% of CVEs· 99th percentile
Metasploit
1 CVE
20.0% of CVEs· 98th percentile
Nuclei
1 CVE
20.0% of CVEs· 98th percentile
ExploitDB
1 CVE
20.0% of CVEs· 87th percentile
Social Chatter
Signals from CVEs in this product scope (5 CVEs).
Media Mentions
Signals from CVEs in this product scope (5 CVEs).
Top CNAs Publishing CVEs For Micros Lucas
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.9.5.7 | 1 | 7.5 | 1.2% | 0 | 0 |
| 2.9.5.6 | 1 | 7.5 | 1.2% | 0 | 0 |
| 2.9.5 | 4 | 7.6 | 27.1% | 1 | 1 |