Unauthenticated Network Vulnerability in Oracle E-Business Suite Maintenance Product
CVE-2024-21038

6.1MEDIUM

Key Information:

Vendor
Oracle
Status
Complex Maintenance Repair And Overhaul
Vendor
CVE Published:
16 April 2024

Summary

A vulnerability exists in the Oracle Complex Maintenance, Repair, and Overhaul component of Oracle E-Business Suite, affecting versions 12.2.3 to 12.2.13. An unauthenticated attacker with network access via HTTP can exploit this weakness, given that the attack requires interaction from an unsuspecting user. The potential impacts include unauthorized updates, inserts, or deletions of accessible data, in addition to unauthorized read access to specific data sets. This vulnerability not only compromises the integrity and confidentiality of the data within the maintenance product but may also affect other interconnected products within the Oracle ecosystem.

References

https://www.oracle.com/security-alerts/cpuapr2024.html

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.