← Vulnerability feed

Vulnerability record · CVE-2018-2891 · published 18 July 2018

CVE-2018-2891: Oracle retail bulk data integration vulnerability

Oracle · Retail Bulk Data Integration

Vulnerability in the Oracle Retail Bulk Data Integration component of Oracle Retail Applications (subcomponent: BDI Job Scheduler). The supported version that is affected is 16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Bulk Data Integration. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Bulk Data Integration, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Bulk Data Integration accessible data as well as unauthorized read access to a subset of Oracle Retail Bulk Data Integration accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

6.1 CVSS 3.0 Medium EPSS 1.1% · top 36.3%
6.1CVSS 3.0 base score, v2 5.8
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Vulnerability in the Oracle Retail Bulk Data Integration component of Oracle Retail Applications (subcomponent: BDI Job Scheduler). The supported version that is affected is 16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Bulk Data Integration. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Bulk Data Integration, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Bulk Data Integration accessible data as well as unauthorized read access to a subset of Oracle Retail Bulk Data Integration accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html PatchVendor Advisory
http://www.securityfocus.com/bid/104829 Third Party AdvisoryVDB Entry
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html PatchVendor Advisory
http://www.securityfocus.com/bid/104829 Third Party AdvisoryVDB Entry

Track CVE-2018-2891 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-22965Spring Framework data binding remote code execution (Spring4Shell)Spring MVC and Spring WebFlux applications on JDK 9+ can be exploited through data binding to achieve remote code execution. The known exploit path r…KEVEPSS 100%analysed7.5CVE-2021-40690Apache santuario xml security for java information exposure vulnerabilityAll versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is…EPSS 7.4%7.5CVE-2020-5398Spring Framework reflected file download via Content-Disposition filenameSpring Framework versions 5.2.x before 5.2.3, 5.1.x before 5.1.13, and 5.0.x before 5.0.16 are vulnerable to reflected file download (RFD) when an ap…EPSS 89%analysed6.5CVE-2022-23437Apache xerces-j vulnerabilityThere's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the Xe…EPSS 12%6.5CVE-2020-5421Vmware spring framework vulnerabilityIn Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against R…EPSS 11%6.3CVE-2020-1945Apache ant exposure of resource to wrong sphere vulnerabilityApache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several …EPSS 1.8%6.1CVE-2019-17091Eclipse mojarra cross-site scripting vulnerabilityfaces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2…EPSS 2.5%5.5CVE-2021-36373Apache ant vulnerabilityWhen reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memo…EPSS 2.5%

Source: NIST National Vulnerability Database (record CVE-2018-2891), CISA KEV, FIRST EPSS (scores of 2026-10-08). This page is refreshed as NVD updates the record.