Unauthenticated Access Vulnerability in Oracle One-to-One Fulfillment by Oracle

CVE-2024-20936

Summary

An unauthenticated access vulnerability exists in Oracle One-to-One Fulfillment, part of the Oracle E-Business Suite, which affects versions 12.2.3 through 12.2.13. This vulnerability allows an attacker with network access via HTTP to manipulate accessible data. While successful attacks require human interaction from a third party, they pose significant risks, leading to unauthorized updates, inserts, or deletions, as well as unintended read access to sensitive data. This vulnerability may extend its impact beyond Oracle One-to-One Fulfillment, altering the scope of potential consequences.

References