Vulnerability in Oracle E-Business Suite: Complex Maintenance, Repair, and Overhaul Component
CVE-2024-21024

6.1MEDIUM

Key Information:

Vendor
Oracle
Status
Complex Maintenance, Repair, And Overhaul
Vendor
CVE Published:
16 April 2024

Summary

A vulnerability exists in the Oracle E-Business Suite, specifically within the Complex Maintenance, Repair, and Overhaul component, allowing unauthenticated attackers with network access to exploit the system. This vulnerability requires interaction from another user, which can lead to unauthorized updates, deletes, or reads of sensitive data within the system. While the primary impact is to the affected component, there are potential risks of broader impacts on associated products due to scope changes during an attack.

Affected Version(s)

Complex Maintenance, Repair, and Overhaul 12.2.3 <= 12.2.13

References

https://www.oracle.com/security-alerts/cpuapr2024.html
vendor-advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.