CVE-2019-2904: Oracle Application Testing Suite

Critical severity, CVSS 9.8. EPSS: 14.3% chance of exploitation in the next 30 days.

Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products

Oracle Application Testing Suite: version 12.5.0.3 only; version 13.1.0.1 only; version 13.2.0.1 only; version 13.3.0.1 only
Oracle Banking Enterprise Collections: version 2.7.0 only; version 2.8.0 only
Oracle Banking Enterprise Originations: version 2.7.0 only; version 2.8.0 only
Oracle Banking Enterprise Product Manufacturing: version 2.7.0 only; version 2.8.0 only
Oracle Banking Platform: version 2.4.0 only; version 2.4.1 only; version 2.5.0 only; version 2.6.0 only; version 2.6.1 only; version 2.6.2 only; …
Oracle Business Process Management Suite: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Clinical: version 5.2 only
Oracle Communications Diameter Signaling Router: from 8.0.0.0, up to and including 8.4.0.5
Oracle Communications Network Integrity: from 7.3.2, up to and including 7.3.6
Oracle Communications Service Broker: version 6.0 only; version 6.1 only
Oracle Communications Services Gatekeeper: version 6.0 only; version 6.1 only
Oracle Enterprise Repository: version 11.1.1.7.0 only
Oracle Financial Services Lending And Leasing: from 14.1.0, up to and including 14.2.0; version 12.5.0 only
Oracle Financial Services Revenue Management And Billing Analytics: version 2.6 only; version 2.7 only; version 2.8 only
Oracle Flexcube Private Banking: version 12.0.0 only; version 12.1.0 only
Oracle Health Sciences Data Management Workbench: version 2.4 only; version 2.5 only
Oracle Hyperion Planning: version 11.1.2.4 only
Oracle Rapid Planning: version 12.1.3 only
Oracle Retail Assortment Planning: version 15.0.3.0 only; version 16.0.3.0 only
Oracle Retail Clearance Optimization Engine: version 13.4 only; version 14.0.3 only; version 14.0.5 only
Oracle Retail Markdown Optimization: version 13.4 only
Oracle Retail Sales Audit: version 15.0.3 only; version 16.0.2 only

Published 2019-10-16. Last modified 2026-06-17.