CVE-2019-2904
Estado: ModificadaCrítica (9.8)—
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 14%
- Percentil entre todas las CVEs puntuadas: 97
- Fecha de la puntuación: 3/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (22)
Oracle — Application Testing SuiteOracle — Banking Enterprise CollectionsOracle — Banking Enterprise OriginationsOracle — Banking Enterprise Product ManufacturingOracle — Banking PlatformOracle — Business Process Management SuiteOracle — ClinicalOracle — Communications Diameter Signaling RouterOracle — Communications Network IntegrityOracle — Communications Service BrokerOracle — Communications Services GatekeeperOracle — Enterprise RepositoryOracle — Financial Services Lending AND LeasingOracle — Financial Services Revenue Management AND Billing AnalyticsOracle — Flexcube Private BankingOracle — Health Sciences Data Management WorkbenchOracle — Hyperion PlanningOracle — Rapid PlanningOracle — Retail Assortment PlanningOracle — Retail Clearance Optimization EngineOracle — Retail Markdown OptimizationOracle — Retail Sales Audit
CWE
- NVD-CWE-noinfo
Referencias
- http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2021.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.zerodayinitiative.com/advisories/ZDI-19-1024/
- http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2021.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.zerodayinitiative.com/advisories/ZDI-19-1024/
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-2904",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2019-2904",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-10-15T17:36:30.925092Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "secalert_us@oracle.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "secalert_us@oracle.com",
"affectedData": [
{
"vendor": "Oracle Corporation",
"product": "Enterprise Repository",
"versions": [
{
"status": "affected",
"version": "11.1.1.7.0"
}
]
},
{
"vendor": "Oracle Corporation",
"product": "Rapid Planning",
"versions": [
{
"status": "affected",
"version": "12.1.3"
}
]
}
]
}
],
"published": "2019-10-16T18:15:27.560",
"references": [
{
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"tags": [
"Vendor Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2021.html",
"tags": [
"Vendor Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html",
"tags": [
"Vendor Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://www.oracle.com/security-alerts/cpujul2020.html",
"tags": [
"Vendor Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html",
"tags": [
"Vendor Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-1024/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secalert_us@oracle.com"
},
{
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2021.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpujul2020.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-1024/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el producto Oracle JDeveloper and ADF de Oracle Fusion Middleware (componente: ADF Faces). Las versiones compatibles que están afectadas son 11.1.1.9.0, 12.1.3.0.0 y 12.2.1.3.0. Una vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red por medio de HTTP comprometer a Oracle JDeveloper and ADF. Los ataques con éxito de esta vulnerabilidad pueden resultar en la toma de control de Oracle JDeveloper and ADF. CVSS 3.0 Puntuación Base 9.8 (Impactos de la Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."
}
],
"lastModified": "2026-06-17T02:34:48.613",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17EA8B91-7634-4636-B647-1049BA7CA088"
},
{
"criteria": "cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5B4DF46F-DBCC-41F2-A260-F83A14838F23"
},
{
"criteria": "cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "10F17843-32EA-4C31-B65C-F424447BEF7B"
},
{
"criteria": "cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A125E817-F974-4509-872C-B71933F42AD1"
},
{
"criteria": "cpe:2.3:a:oracle:banking_enterprise_collections:2.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFB663EB-1E06-428B-BE2D-AECFF7F1A025"
},
{
"criteria": "cpe:2.3:a:oracle:banking_enterprise_collections:2.8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3753A492-B62D-4E4A-8D60-C1AC1F71419B"
},
{
"criteria": "cpe:2.3:a:oracle:banking_enterprise_originations:2.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7AB8ABFD-C72C-4CBB-8872-9440A19154D6"
},
{
"criteria": "cpe:2.3:a:oracle:banking_enterprise_originations:2.8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3054FEBB-484B-4927-9D1C-2024772E8B3D"
},
{
"criteria": "cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5AED3C78-7D65-4F02-820D-B51BCE4022F9"
},
{
"criteria": "cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "557A23A1-4762-4D29-A478-D1670C1847D3"
},
{
"criteria": "cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2BEE49E-A5AA-42D3-B422-460454505480"
},
{
"criteria": "cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4FF66F7-10C8-4A1C-910A-EF7D12A4284C"
},
{
"criteria": "cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "35AD0C07-9688-4397-8D45-FBB88C0F0C11"
},
{
"criteria": "cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8972497F-6E24-45A9-9A18-EB0E842CB1D4"
},
{
"criteria": "cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "400509A8-D6F2-432C-A2F1-AD5B8778D0D9"
},
{
"criteria": "cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "132CE62A-FBFC-4001-81EC-35D81F73AF48"
},
{
"criteria": "cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "282150FF-C945-4A3E-8A80-E8757A8907EA"
},
{
"criteria": "cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "645AA3D1-C8B5-4CD2-8ACE-31541FA267F0"
},
{
"criteria": "cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB9FC9AB-1070-420F-870E-A5EC43A924A4"
},
{
"criteria": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E869C417-C0E6-4FC3-B406-45598A1D1906"
},
{
"criteria": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFEFE2C0-7B98-44F9-B3AD-D6EC607E90DA"
},
{
"criteria": "cpe:2.3:a:oracle:clinical:5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F60487A7-386A-4C86-9456-53D1F437CE0C"
},
{
"criteria": "cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "12981AA7-BBF6-4158-8F7D-9DD3880FDCC1",
"versionEndIncluding": "8.4.0.5",
"versionStartIncluding": "8.0.0.0"
},
{
"criteria": "cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABD748C9-24F6-4739-9772-208B98616EE2",
"versionEndIncluding": "7.3.6",
"versionStartIncluding": "7.3.2"
},
{
"criteria": "cpe:2.3:a:oracle:communications_service_broker:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "373C4024-679F-4C37-B408-0FB0D7FD845F"
},
{
"criteria": "cpe:2.3:a:oracle:communications_service_broker:6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B1B6C73-F0DC-48AA-BD31-FD3FAEC22F58"
},
{
"criteria": "cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA4E8A1E-FBB5-4EAC-9A7F-6FE95A1B5F60"
},
{
"criteria": "cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3287751-9F54-4806-81D2-E28A42DF1407"
},
{
"criteria": "cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69300B13-8C0F-4433-A6E8-B2CE32C4723D"
},
{
"criteria": "cpe:2.3:a:oracle:financial_services_lending_and_leasing:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FCDA89CD-FE10-47AA-9F64-F4BC93E44755",
"versionEndIncluding": "14.2.0",
"versionStartIncluding": "14.1.0"
},
{
"criteria": "cpe:2.3:a:oracle:financial_services_lending_and_leasing:12.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "317CA916-61F3-4E24-B42F-610A1C88A5BA"
},
{
"criteria": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A51A10EB-10A9-48EE-9B24-AEE2ABACE9C5"
},
{
"criteria": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4CCE1968-016C-43C1-9EE1-FD9F978B688F"
},
{
"criteria": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5B5DBF4C-84BB-4537-BD8D-E10C5A4B69F4"
},
{
"criteria": "cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6762F207-93C7-4363-B2F9-7A7C6F8AF993"
},
{
"criteria": "cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1B74B912-152D-4F38-9FC1-741D6D0B27FC"
},
{
"criteria": "cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "271745B7-203F-4025-ACF0-C7CA40EE1643"
},
{
"criteria": "cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6C07C54-1A10-4063-87F1-E4A371695149"
},
{
"criteria": "cpe:2.3:a:oracle:hyperion_planning:11.1.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86045AB3-7CCA-49D0-B6FA-DA57A55248DE"
},
{
"criteria": "cpe:2.3:a:oracle:rapid_planning:12.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "10578046-1907-4B2B-B8DE-80B3DE6AA476"
},
{
"criteria": "cpe:2.3:a:oracle:retail_assortment_planning:15.0.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "44357172-4035-4D57-9C83-D80BDDE8E8C7"
},
{
"criteria": "cpe:2.3:a:oracle:retail_assortment_planning:16.0.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDDD1BFF-9B0D-45DA-86DC-05CF829107FB"
},
{
"criteria": "cpe:2.3:a:oracle:retail_clearance_optimization_engine:13.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B13EC6F1-1EB7-4A71-8298-A9140C0F6EBB"
},
{
"criteria": "cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D31A422-0B1D-415E-A551-26B8449017DF"
},
{
"criteria": "cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FE91D517-D85D-4A8D-90DC-4561BBF8670E"
},
{
"criteria": "cpe:2.3:a:oracle:retail_markdown_optimization:13.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32E89B1F-7746-47A6-93A2-E7EB69A85EA1"
},
{
"criteria": "cpe:2.3:a:oracle:retail_sales_audit:15.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "12AFC92F-E46B-4382-9302-26F27B79723C"
},
{
"criteria": "cpe:2.3:a:oracle:retail_sales_audit:16.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5AA4401-E672-4E34-A7DB-5F8F93C3A4F9"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert_us@oracle.com"
}