← Vulnerability feed

Vulnerability record · CVE-2018-3027 · published 18 July 2018

CVE-2018-3027: Oracle banking payments vulnerability

Oracle · Banking Payments

Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions that are affected are 12.2.0, 12.3.0, 12.4.0, 12.5.0 and 14.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Payments accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

8.1 CVSS 3.0 High EPSS 2.0% · top 20.0%
8.1CVSS 3.0 base score, v2 5.5
2.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions that are affected are 12.2.0, 12.3.0, 12.4.0, 12.5.0 and 14.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Payments accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html PatchVendor Advisory
http://www.securityfocus.com/bid/104790 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041307 Third Party AdvisoryVDB Entry
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html PatchVendor Advisory
http://www.securityfocus.com/bid/104790 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041307 Third Party AdvisoryVDB Entry

Track CVE-2018-3027 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-13990Softwareag quartz xml external entity (xxe) vulnerabilityinitDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.EPSS 16%8.8CVE-2018-2705Oracle banking payments vulnerabilityVulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions th…EPSS 1.7%8.1CVE-2018-2704Oracle banking payments vulnerabilityVulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (subcomponent: Payments Core). Supported versions th…EPSS 1.8%7.5CVE-2021-35515Apache commons compress vulnerabilityWhen reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This cou…EPSS 12%7.5CVE-2021-35517Apache commons compress allocation without limits vulnerabilityWhen reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error e…EPSS 11%7.5CVE-2021-36090Apache commons compress vulnerabilityWhen reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error e…EPSS 13%7.5CVE-2019-12399Apache kafka cleartext transmission vulnerabilityWhen Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a conne…EPSS 3.9%7.5CVE-2019-12402Apache commons compress vulnerabilityThe file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially craf…EPSS 16%

Source: NIST National Vulnerability Database (record CVE-2018-3027), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.