PT-2023-6180 · Oracle · Oracle Enterprise Command Center Framework

Publicado 2023-10-17 · Atualizado 2023-10-23 · CVE-2023-22106

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Command Center Framework versions 8 through 10

Description The issue is related to insufficient input validation in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite, specifically in the API component. This allows a low-privileged attacker with network access via HTTP to compromise the framework, resulting in unauthorized access to critical data or complete access to all accessible data.

Recommendations For versions 8 through 10, consider restricting access to the API component until a patch is available. As a temporary workaround, disabling the vulnerable API endpoint may help minimize the risk of exploitation. Restricting network access via HTTP to the Oracle Enterprise Command Center Framework can also help reduce the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-06889

CVE-2023-22106

Produtos afetados

Oracle Enterprise Command Center Framework

Referências · 7

• https://twitter.com/CVEnew/status/1714390714593743133 · Publicação no Twitter
• https://oracle.com/security-alerts/cpuoct2023.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-22106 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-06889 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB20231018117 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-22106 · Nota de Segurança
• https://docs.oracle.com/cd/E26401_01/doc.122/e22956/T27641T671922.htm · Nota