Vulnerability in Oracle Knowledge Management of Oracle E-Business Suite
CVE-2024-20940

6.1MEDIUM

Key Information:

Vendor
Oracle
Status
Knowledge Management
Vendor
CVE Published:
16 January 2024

Summary

A vulnerability exists in the Create, Update, Authoring Flow component of Oracle Knowledge Management within Oracle E-Business Suite, affecting versions from 12.2.3 to 12.2.13. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, requiring human interaction to succeed. While the vulnerability is localized within Oracle Knowledge Management, its successful exploitation may lead to unauthorized updates, inserts, or deletions of accessible data, as well as unauthorized readings of sensitive data. The ramifications extend beyond just the Oracle Knowledge Management product, potentially impacting related systems and data integrity.

Affected Version(s)

Knowledge Management 12.2.3 <= 12.2.13

References

https://www.oracle.com/security-alerts/cpujan2024.html
vendor-advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.