VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 20 hours ago

CVE-2018-2719

6.1 Medium No fix identified

Description

Vulnerability in the Oracle Financial Services Hedge Management and IFRS Valuations component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Hedge Management and IFRS Valuations. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Hedge Management and IFRS Valuations, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Hedge Management and IFRS Valuations accessible data as well as unauthorized read access to a subset of Oracle Financial Services Hedge Management and IFRS Valuations accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 8 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.1% chance in 30 days

Waratek Defense Posture

No fix identified

In RASP's scope, but nothing published names a fix and nothing published shows an exploit. Neither of the two things VRT can act on exists, which is a claim about the available evidence, not about the vulnerability.

  • Protection none
  • Action not-needed
  • Review automated upstream-data
  • Record active
Decided by no-exploit : With no fix path, a public exploit, or a CISA record of one
Finding Resolved from QUEUED-FOR-REVIEW: this CVE affects a known product, but nothing published names a fix and nothing published shows an exploit. That is a statement about the evidence, not about the defect — it does not mean the vulnerability is unimportant or unreachable, only that neither of the two things VRT can act on exists.

CVSS

6.1 MEDIUM v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.0 6.1 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary published
CVSS 2.0 5.8 no band published AV:N/AC:M/Au:N/C:P/I:P/A:N NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update January 2018 ↗ CPU 2018-Q1 Oracle Financial Services Applications / User Interface (8.0.x)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Financial Services Applications User Interface 8.0.x 8.0

🖥️ Product CPEs & Version Ranges

1 product(s) over 1 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd oracle financial services hedge management and ifrs valuations generic 8.0.5.0.0

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/102653 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040214 Third Party Advisory, VDB Entry

Timeline

Published 2018-01-18 Last modified 2026-06-17
Published2018-01-18By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.