CVE-2018-2636 Auth bypass in Hospitality Simphony

What is CVE-2018-2636?

CVE-2018-2636 is a high-severity authentication bypass vulnerability in Oracle Corporation Hospitality Simphony, published on 18 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security). Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Which versions are affected by CVE-2018-2636?

It affects 1 product.

Products include Oracle Hospitality Simphony.

How do I fix CVE-2018-2636?

No fix has been published for CVE-2018-2636 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-2636 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-2636 exists.

Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.

Other vulnerabilities in Oracle Corporation Hospitality Simphony

• CVE-2024-20997 Auth bypass in Hospitality Simphony Critical 9.9
• CVE-2024-21010 Missing authorization in Hospitality Simphony Critical 9.9
• CVE-2024-21014 Auth bypass in Hospitality Simphony Critical 9.8
• CVE-2026-60591 Missing authorization in Oracle Hospitality Simphony Critical 9.1
• CVE-2026-60168 Missing authorization in Oracle Hospitality Simphony Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fc59-v87q-7frq.