CVE-2019-2713
CVE-2019-2713 is a medium-severity vulnerability in Oracle Commerce Merchandising with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v2: 6.4
- EPSS exploit prediction: 1% (59th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Oracle Commerce Merchandising
- Published:
- Last modified:
Description
Vulnerability in the Oracle Commerce Merchandising component of Oracle Commerce (subcomponent: Asset Manager). The supported version that is affected is 11.2.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Merchandising. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Merchandising accessible data as well as unauthorized read access to a subset of Oracle Commerce Merchandising accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Frequently asked questions
- What is CVE-2019-2713?
- Vulnerability in the Oracle Commerce Merchandising component of Oracle Commerce (subcomponent: Asset Manager). The supported version that is affected is 11.2.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Merchandising. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Merchandising accessible data as well as unauthorized read access to a subset of Oracle Commerce Merchandising accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
- How severe is CVE-2019-2713?
- CVE-2019-2713 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2019-2713 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (59th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-2713?
- CVE-2019-2713 affects Oracle Commerce Merchandising. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2019-2713?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2019-2713 published?
- CVE-2019-2713 was published on 2019-04-23 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:oracle:commerce_merchandising:11.2.0.3:*:*:*:*:*:*:*
More vulnerabilities in Oracle Commerce Merchandising
- CVE-2021-32808 — High (CVSS 7.6): ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the…
- CVE-2021-37695 — High (CVSS 7.3): ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered…
- CVE-2022-24729 — Medium (CVSS 6.5): CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a…
- CVE-2021-26272 — Medium (CVSS 6.5): It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted…
- CVE-2020-27193 — Medium (CVSS 6.1): A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to…
- CVE-2022-24728 — Medium (CVSS 5.4): CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core…