What’s Vulnerable › Vulnerabilities
CVE-2019-2904
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 14.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-10-16 · updated 2026-06-17
Description
Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected products
- Oracle Corporation Oracle Application Testing Suite: 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
- Oracle Banking Enterprise Collections: 2.7.0, 2.8.0
- Oracle Banking Enterprise Originations: 2.7.0, 2.8.0
- Oracle Banking Enterprise Product Manufacturing: 2.7.0, 2.8.0
- Oracle Banking Platform: 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2 (+3)
- Oracle Corporation Oracle Business Process Management Suite: 12.2.1.3.0, 12.2.1.4.0
- Oracle Clinical: 5.2
- Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0.0 through 8.4.0.5
- Oracle Communications Network Integrity: from 7.3.2 through 7.3.6
- Oracle Communications Service Broker: 6.0, 6.1
- Oracle Communications Services Gatekeeper: 6.0, 6.1
- Oracle Corporation Enterprise Repository: 11.1.1.7.0
- Oracle Financial Services Lending And Leasing: from 14.1.0 through 14.2.0; 12.5.0
- Oracle Financial Services Revenue Management And Billing Analytics: 2.6, 2.7, 2.8
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Corporation Health Sciences Data Management Workbench: 2.4, 2.5
- Oracle Corporation Hyperion Planning: 11.1.2.4
- Oracle Corporation Rapid Planning: 12.1.3
- Oracle Retail Assortment Planning: 15.0.3.0, 16.0.3.0
- Oracle Retail Clearance Optimization Engine: 13.4, 14.0.3, 14.0.5
- Oracle Retail Markdown Optimization: 13.4
- Oracle Retail Sales Audit: 15.0.3, 16.0.2
References
- http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2021.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.zerodayinitiative.com/advisories/ZDI-19-1024/
- http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2021.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
Get alerted when CVE-2019-2904 or the next vulnerability affects your stack