Unauthorized Access Vulnerability in Oracle E-Business Suite's Maintenance Product
CVE-2024-21036

6.1MEDIUM

Key Information:

Vendor
Oracle
Status
Complex Maintenance, Repair, And Overhaul
Vendor
CVE Published:
16 April 2024

Summary

A vulnerability exists in the Oracle Complex Maintenance, Repair, and Overhaul component of the Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.13. It allows unauthenticated remote attackers to exploit the system via HTTP, potentially leading to unauthorized updates, insertion, deletion of data, and unauthorized reading of sensitive information. Successful exploitation necessitates human interaction from a user other than the attacker, which heightens the risk of data compromise across associated products.

Affected Version(s)

Complex Maintenance, Repair, and Overhaul 12.2.3 <= 12.2.13

References

https://www.oracle.com/security-alerts/cpuapr2024.html
vendor-advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.