Oracle Corporation ODBC Driver
At a glance
- Source
- NVD
- EPSS
- EPSS 1.23 % · percentile 69 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- oracle
- NVD status
- Modified
Description
Vulnerability in the Oracle ODBC Driver component of Oracle Database Server<span class=font-red><b> ***PRIVILEGE CANNOT BE NONE FOR AUTHENTICATED ATTACKS***</b></span>. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Difficult to exploit vulnerability allows low privileged attacker having None privilege with network access via multiple protocols to compromise Oracle ODBC Driver. Successful attacks of this vulnerability can result in takeover of Oracle ODBC Driver. Note: The vulnerability affects Windows platforms only. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2019-12438
- GCVE · GCVE-0-2019-2799
CERT-FR advisories
- CERTFR-2019-AVI-339 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:oracle:database_server:11.2.0.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:database_server:12.1.0.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Oracle Corporation · ODBC Driver | affected 11.2.0.4 ; affected 12.1.0.2 ; affected 12.2.0.1 ; affected 18c |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |