Unauthenticated Network Vulnerability in Oracle Hospitality Simphony POS by Oracle

CVE-2024-20989

What is CVE-2024-20989?

A vulnerability exists in the Oracle Hospitality Simphony product, particularly affecting the Simphony POS component and versions ranging from 19.1.0 to 19.5.4. This vulnerability allows an unauthenticated attacker with network access via HTTP to breach the security of Oracle Hospitality Simphony. If successfully exploited, the vulnerability can lead to unauthorized access to critical data, as well as total accessibility to all data handled by Oracle Hospitality Simphony. Furthermore, it enables unauthorized actions such as updates, inserts, or deletions of certain data, and can result in a limited denial of service, impacting the overall functionality of the product.

References