PT-2023-9067 · Oracle · Oracle Hospitality Simphony

CVE-2024-21014 · Publicado 2023-12-07 · Atualizado 2024-11-27

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Simphony versions 19.1.0 through 19.5.4

Description The issue is related to insufficient input validation in the Simphony Enterprise Server component. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony, potentially resulting in a takeover. The estimated number of potentially affected devices is not specified.

Recommendations For versions 19.1.0 through 19.5.4, update to a version that addresses this issue, as the current version allows for easy exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

RCE

Enumeração de Fraquezas

CWE-306

CWE-20

Identificadores relacionados

BDU:2024-03398

CVE-2024-21014

Produtos afetados

Oracle Hospitality Simphony

Referências · 9

• https://cybersecurity-help.cz/vdb/SB2024041749 · Nota
• https://twitter.com/CVEnew/status/1780363497483976797 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2024-03398 · Nota de Segurança
• https://vuldb.com/ru/?id.261086 · Nota
• https://safe-surf.ru/upload/VULN-new/VULN.2024-04-19.1.pdf · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2024-21014 · Nota de Segurança
• https://twitter.com/cracbot/status/1780495250315760111 · Publicação no Twitter
• https://oracle.com/security-alerts/cpuapr2024.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2024-21014 · Aviso do Fabricante