Unauthenticated HTTP Vulnerability in Oracle E-Business Suite's Maintenance Product
CVE-2024-21026

6.1MEDIUM

Key Information:

Vendor
Oracle
Status
Complex Maintenance, Repair, And Overhaul
Vendor
CVE Published:
16 April 2024

Summary

An unpatched vulnerability in Oracle's Complex Maintenance, Repair, and Overhaul component allows unauthenticated attackers to exploit the system through HTTP. Attackers can gain unauthorized access to data, permitting updates, inserts, or deletions without detection. Successful exploitation necessitates human interaction from a user, potentially leading to significant data breaches across other interconnected applications within the Oracle E-Business Suite.

Affected Version(s)

Complex Maintenance, Repair, and Overhaul 12.2.3 <= 12.2.13

References

https://www.oracle.com/security-alerts/cpuapr2024.html
vendor-advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.