PT-2023-6271 · Oracle · Oracle Commerce Guided Search

Jeffrey Mcclure · Publicado 2023-10-17 · Atualizado 2023-10-23 · CVE-2023-22029

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search version 11.3.2

Description The issue is related to insufficient input validation in the Workbench component of Oracle Commerce Guided Search. This easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. Attacks can result in unauthorized update, insert, or delete access to some of Oracle Commerce Guided Search accessible data, as well as unauthorized read access to a subset of Oracle Commerce Guided Search accessible data.

Recommendations For Oracle Commerce Guided Search version 11.3.2, consider restricting access to the Workbench component until a patch is available. As a temporary workaround, limit the use of the vulnerable component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-06981

CVE-2023-22029

Produtos afetados

Oracle Commerce Guided Search

Referências · 7

• https://t.me/cvenotify/59617 · Publicação no Telegram
• https://oracle.com/security-alerts/cpuoct2023.html · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1714390764795416837 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-22029 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-22029 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-06981 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1714454451245711511 · Publicação no Twitter