CVE-2019-2872

Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Point of Sale). Supported versions that are affected are 17.0.3, 18.0.1 and 19.0.0. Difficult to exploit vulnerability allows physical access to compromise Oracle Retail Xstore Point of Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.0 Base Score 2.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N).

CVSS v3 2.7 LOW
CVSS v2.0 2.6 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.1 / Impact : 2.5

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:H/Au:N/C:P/I:P/A:N

Exploitability : 1.9 / Impact : 4.9

Access Vector LOCAL

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.3:::::::*
	cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.1:::::::*
	cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.0:::::::*

History

No history.

Information

Published : 2019-10-16 18:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-2872

Mitre link : CVE-2019-2872

CVE.ORG link : CVE-2019-2872

JSON object : View

Products Affected

oracle

retail_xstore_point_of_service

CWE

NVD-CWE-noinfo

{"id": "CVE-2019-2872", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 1.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.1}]}, "published": "2019-10-16T18:15:26.340", "references": [{"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Point of Sale). Supported versions that are affected are 17.0.3, 18.0.1 and 19.0.0. Difficult to exploit vulnerability allows physical access to compromise Oracle Retail Xstore Point of Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.0 Base Score 2.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N)."}, {"lang": "es", "value": "Una vulnerabilidad en el producto Oracle Retail Xstore Point of Service de Oracle Retail Applications (componente: Point of Sale). Las versiones compatibles afectadas son 17.0.3, 18.0.1 y 19.0.0. Una vulnerabilidad dif\u00edcil de explotar permite que el acceso f\u00edsico comprometa a Oracle Retail Xstore Point of Service. Los ataques con \u00e9xito requieren la interacci\u00f3n humana de otra persona diferente del atacante. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en actualizar, insertar o eliminar de forma no autorizada el acceso a algunos de los datos accesibles de Oracle Retail Xstore Point of Service, as\u00ed como tambi\u00e9n el acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle Retail Xstore Point of Service. CVSS 3.0 Puntuaci\u00f3n Base 2.7 (Impactos de la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N)."}], "lastModified": "2019-10-17T19:27:46.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6308E929-D44D-48A1-BAEE-47BE4E164124"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A34C1AF7-C18D-424C-BD3F-F773A9E53DCA"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "080F440B-C5C6-4888-A61C-02468D3DFDFD"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}