The Patching Friars' AlmanacA calendar of CVE saints

November 19

PAYDAYHoly card for payday, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 $ PAYDAY DIES MERCEDIS
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint PAYDAY, Who Settled Oracle's Accounts

Patron of Oracle E-Business Suite systems, production modules, and everyone who keeps the books open to the Internet.

Life

On 19 November 2019 Onapsis described PAYDAY, a pair of vulnerabilities in the Work in Process module of Oracle E-Business Suite. A low-privileged attacker, over HTTP, could create, delete or modify critical data in production and administration systems, reaching as far as payments and orders. Oracle fixed them in the quarterly bulletin; the name promised the attacker a real payday (CVE-2019-2633, CVE-2019-2638).

Prayer

O Saint PAYDAY, who opens the ledger's cash drawer, let our accounts not be settled by strangers' hands. Amen.

How to celebrate

Celebrated by applying the Oracle critical patch updates and taking the business systems off the public network.

An exposed ledger is payday for thieves.

Technical record

Disclosed on
November 19 2019
CVE
CVE-2019-2633CVE-2019-2638
Product
Oracle Corporation · Work in Process

Vulnerability in the Oracle Work in Process component of Oracle E-Business Suite (subcomponent: Messages). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Work in Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).

Sources: onapsis.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.