Unauthenticated Access Vulnerability in Oracle E-Business Suite's Customer Interaction History

CVE-2021-2106

Summary

An easily exploitable vulnerability exists in the Oracle Customer Interaction History component of Oracle E-Business Suite. This flaw allows an unauthenticated attacker with network access via HTTP to compromise sensitive Oracle data without needing direct access. While the vulnerability primarily resides in the Customer Interaction History feature, its exploitation could extend to affect additional products within the Oracle ecosystem. Successful exploitation necessitates human interaction from a different user. Attackers leveraging this vulnerability risk unauthorized access to critical data, as well as the capability to execute unauthorized modifications such as updates, insertions, or deletions of accessible data.

References