PT-2023-9573 · Oracle · Oracle E-Business Suite

CVE-2024-21282 · Publicado 2023-12-07 · Atualizado 2024-10-21

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.3 through 12.2.13

Description The issue is related to weaknesses in the authorization mechanism of the Common Components component in Oracle Financials, part of the Oracle E-Business Suite. This can allow a remote attacker to gain unauthorized access to create, modify, or delete data using the HTTP protocol. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Financials accessible data.

Recommendations For versions 12.2.3 through 12.2.13, consider restricting access to the vulnerable component until a patch is available. As a temporary workaround, limit network access via HTTP to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Incorrect Authorization

Improper Authorization

Enumeração de Fraquezas

CWE-20

CWE-863

CWE-285

Identificadores relacionados

BDU:2024-08455

CVE-2024-21282

Produtos afetados

Oracle E-Business Suite

Referências · 9

• https://vuldb.com/ru/?id.280467 · Nota
• https://bdu.fstec.ru/vul/2024-08455 · Nota de Segurança
• https://twitter.com/CVEnew/status/1846284298938171544 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-21282 · Aviso do Fabricante
• https://oracle.com/security-alerts/cpuoct2024.html · Aviso do Fabricante
• https://t.me/cvenotify/98992 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-21282 · Nota de Segurança
• https://t.me/cvedetector/7952 · Publicação no Telegram
• https://docs.oracle.com/cd/E18727-01/doc.121/e13424/T433149T433152.htm · Nota