How severe is CVE-2018-2738?

CVE-2018-2738 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2018-2738 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-2738?

CVE-2018-2738 primarily affects Oracle Retail Central Office. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2018-2738?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2018-2738 published?

CVE-2018-2738 was published on 2018-04-19 and last updated on 2026-06-17.

CVE-2018-2738

CVE-2018-2738 is a medium-severity vulnerability in Oracle Retail Central Office with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 6.4
EPSS exploit prediction: 1% (62nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Oracle Retail Central Office
Published: 2018-04-19
Last modified: 2026-06-17

Description

Vulnerability in the Oracle Retail Central Office component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Central Office. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Central Office accessible data as well as unauthorized read access to a subset of Oracle Retail Central Office accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Frequently asked questions

What is CVE-2018-2738?: Vulnerability in the Oracle Retail Central Office component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Central Office. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Central Office accessible data as well as unauthorized read access to a subset of Oracle Retail Central Office accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
How severe is CVE-2018-2738?: CVE-2018-2738 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2018-2738 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-2738?: CVE-2018-2738 primarily affects Oracle Retail Central Office. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2018-2738?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-2738 published?: CVE-2018-2738 was published on 2018-04-19 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:oracle:retail_central_office:13.4.9:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_central_office:14.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_central_office:14.1.3:*:*:*:*:*:*:*

More vulnerabilities in Oracle Retail Central Office

CVE-2019-13990 — Critical (CVSS 9.8): initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE…
CVE-2018-8013 — Critical (CVSS 9.8): In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the…
CVE-2018-1270 — Critical (CVSS 9.8): Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow…
CVE-2018-1258 — High (CVSS 8.8): Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization…
CVE-2021-2351 — High (CVSS 8.3): Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are…
CVE-2020-11987 — High (CVSS 8.2): Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the…

All CVEs affecting Oracle Retail Central Office →