peter bassill · operator
$ cve CVE-2019-2904 JSON

CVE-2019-2904

9.8
CRITICAL · CVSS 3.1 · EPSS 14.3% (pctl 97)

Patch early

EPSS 14.3% — above the 10% action threshold.

Description

Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS14.26% — more likely to be exploited than 97% of all CVEs
On CISA KEVno
Public exploitnone known
Published2019-10-16
Last modified2026-06-17

Affected (22)

VendorProduct
oracleapplication testing suite
oraclebanking enterprise collections
oraclebanking enterprise originations
oraclebanking enterprise product manufacturing
oraclebanking platform
oraclebusiness process management suite
oracleclinical
oraclecommunications diameter signaling router
oraclecommunications network integrity
oraclecommunications service broker
oraclecommunications services gatekeeper
oracleenterprise repository
oraclefinancial services lending and leasing
oraclefinancial services revenue management and billing analytics
oracleflexcube private banking
oraclehealth sciences data management workbench
oraclehyperion planning
oraclerapid planning
oracleretail assortment planning
oracleretail clearance optimization engine
oracleretail markdown optimization
oracleretail sales audit

References

→ the Explorer  ·  watch your stack  ·  NVD