Vulnerability in Oracle Transportation Management UI Infrastructure
CVE-2021-35616

5.4MEDIUM

Key Information:

Vendor
Oracle
Status
Transportation Management
Vendor
CVE Published:
20 October 2021

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability exists in the UI Infrastructure of Oracle Transportation Management, affecting version 6.4.3. This flaw allows low privileged attackers with network access via HTTP to exploit the system. Attackers may gain unauthorized access that includes the ability to perform update, insert, or delete operations on accessible data. Additionally, the vulnerability puts certain accessible data at risk of unauthorized read access, leading to potential data breaches. This compromise poses serious implications for data confidentiality and integrity.

Affected Version(s)

Transportation Management 6.4.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

OracleOTM
Created by Ofirhamam

References

https://www.oracle.com/security-alerts/cpuoct2021.html
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.