Vulnerability in Oracle iProcurement of Oracle E-Business Suite

CVE-2023-21973

Summary

A vulnerability exists in Oracle iProcurement within the Oracle E-Business Suite's E-Content Manager Catalog component. This flaw allows a low-privileged attacker with network access via HTTP to compromise the system. Although reliance on human interaction from an external party is required for exploitation, successful attacks can lead to unauthorized updates, insertions, or deletions of data within Oracle iProcurement. Furthermore, attackers may gain unauthorized read access to certain datasets. The potential for these attacks could extend beyond just Oracle iProcurement, affecting other products and increasing the breadth of the attack's impact.

References