CVE-2018-2575

Oracle Corporation Oracle Database

LOW 2.0

En bref

Source: NVD
EPSS: EPSS 0.89 % · centile 59 (2026-10-28)
État: PUBLISHED
Publiée: 2018-01-18 02:00 UTC
Mise à jour: 2024-10-03 20:45 UTC
Attribuée par: oracle
Statut NVD: Modified

Description

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, and 12.2.0.1. Difficult to exploit vulnerability allows high privileged attacker having Local Logon privilege with network access via multiple protocols to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. Note: Applicable only to Windows platform. CVSS 3.0 Base Score 2.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N).

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.0	LOW 2.0	CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	LOW 2.1	AV:N/AC:H/Au:S/C:P/I:N/A:N	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2018-14430
GCVE · GCVE-0-2018-2575

Avis du CERT-FR

CERTFR-2018-AVI-035 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:oracle:database_server:11.2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Oracle Corporation · Oracle Database	affected 11.2.0.4 ; affected 12.1.0.2 ; affected 12.2.0.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD