CVE-2018-2789 Information disclosure in Siebel Core - Server Framework

Medium 5.0 Published 19 Apr 2018 Updated 3 Oct 2024

A low-privileged attacker can exploit a vulnerability in Oracle Siebel CRM to gain unauthorized read access to sensitive data via HTTP.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-2789?

CVE-2018-2789 is a medium-severity vulnerability in Oracle Corporation Siebel Core - Server Framework, published on 19 Apr 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Vulnerability in the Siebel Core - Server Framework component of Oracle Siebel CRM (subcomponent: Services). The supported version that is affected is 17.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Core - Server Framework. While the vulnerability is in Siebel Core - Server Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel Core - Server Framework accessible data. CVSS 3.0 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).

Which versions are affected by CVE-2018-2789?

It affects 1 product.

Products include Oracle Siebel Core-Server Framework.

How do I fix CVE-2018-2789?

No fix has been published for CVE-2018-2789 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-2789 being exploited?

There is no known exploitation of CVE-2018-2789 in the wild and no public exploit code.

Sources

Also known as GHSA-wjrm-gvgx-jgvr.