Unauthorized Data Access in Oracle Purchasing by Oracle Corporation
CVE-2024-21132

5.4MEDIUM

Key Information:

Vendor
Oracle
Status
Purchasing
Vendor
CVE Published:
16 July 2024

Summary

A vulnerability exists in the Oracle Purchasing component of Oracle E-Business Suite, allowing low-privileged attackers with network access via HTTP to exploit the system. Successful exploitation requires interaction from a user other than the attacker, leading to unauthorized update, insert, or delete actions on Oracle Purchasing data. Additionally, attackers might gain unauthorized read access to certain subsets of Oracle Purchasing accessible data. This issue may also impact other products within the suite, significantly broadening the scope of potential threats.

Affected Version(s)

Purchasing 12.2.3 <= 12.2.13

References

https://www.oracle.com/security-alerts/cpujul2024.html
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.