Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Vulnerability in the Oracle Transportation Management component of Oracle Supply Chain Products Suite (subcomponent: UI Infrastructure). Supported versions that are affected are 6.3.7, 6.4.1, 6.4.2 and 6.4.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Transportation Management accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | Transportation Management | 6.3.7; 6.4.1; 6.4.2; 6.4.3 | — | No fix listed | CNA |
- Transportation Management VendorOracle Affected 6.3.7; 6.4.1; 6.4.2; 6.4.3 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:* | 6.3.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.4.1:*:*:*:*:*:*:* | 6.4.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.4.2:*:*:*:*:*:*:* | 6.4.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.4.3:*:*:*:*:*:*:* | 6.4.3 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:* Versions 6.3.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.4.1:*:*:*:*:*:*:* Versions 6.4.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.4.2:*:*:*:*:*:*:* Versions 6.4.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.4.3:*:*:*:*:*:*:* Versions 6.4.3 Vulnerable ·Oracle
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-2487
- 2026-10-03 Alias added: GHSA-9hcq-g679-523x
More Oracle Transportation Management vulnerabilities
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
- TI-2020-07593 Deserialization of untrusted data in Apache Tomcat CVSS 3.1HIGH 7.0
- TI-2015-02826 The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2019-2487 · CVE Program
- CVE-2019-2487 · NVD
- FIRST EPSS
- GHSA-9hcq-g679-523x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences