CVE-2018-2861: oracle corporation retail back office
Vulnerability summary
CVE-2018-2861 is a medium (CVSS 6.5) vulnerability in oracle corporation retail back office. EPSS estimates a 1.51% chance of exploitation in the next 30 days, higher than 74% of scored vulnerabilities.
Timeline
- 19-04-2018PublishedVulnerability first disclosed.
- 03-10-2024Last modifiedVulnerability information updated.
Description
Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Back Office. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Retail Back Office accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Back Office. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.51%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
-0.03 pp
From 1.54% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle1 product
- retail_back_office13.4.9 | 14.0.4 | 14.1.3
Oracle corporation1 product
- retail back office13.4.9 | 14.0.4 | 14.1.3
2 vendors · 2 products
References
2 links- www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlX Refsource CONFIRMPatchVendor Advisory