CVE-2018-2956 Auth bypass in Hospitality OPERA 5 Property Services
An unauthenticated attacker with local access can compromise Oracle Hospitality OPERA 5 Property Services, leading to full system takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-2956?
CVE-2018-2956 is a high-severity authentication bypass vulnerability in Oracle Corporation Hospitality OPERA 5 Property Services, published on 18 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: Integration). The supported version that is affected is 5.5.x. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitality OPERA 5 Property Services executes to compromise Oracle Hospitality OPERA 5 Property Services. While the vulnerability is in Oracle Hospitality OPERA 5 Property Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality OPERA 5 Property Services. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
Which versions are affected by CVE-2018-2956?
It affects 1 product.
Products include Oracle Hospitality Opera Property Management.
How do I fix CVE-2018-2956?
No fix has been published for CVE-2018-2956 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-2956 being exploited?
There is no known exploitation of CVE-2018-2956 in the wild and no public exploit code.
Other vulnerabilities in Oracle Corporation Hospitality OPERA 5 Property Services
- CVE-2018-2957 Information disclosure in Hospitality OPERA 5 Property Services
- CVE-2020-2675 Missing authorization in Hospitality OPERA 5 Property Services
- CVE-2018-3013 Information disclosure in Hospitality OPERA 5 Property Services
- CVE-2018-3014 Information disclosure in Hospitality OPERA 5 Property Services
- CVE-2020-2676 Other in Hospitality OPERA 5 Property Services
Sources
Also known as GHSA-gr6x-hpfj-53mh.