PT-2023-6180 · Oracle · Oracle Enterprise Command Center Framework

Published 2023-10-17 · Updated 2023-10-23 · CVE-2023-22106

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Command Center Framework versions 8 through 10

Description The issue is related to insufficient input validation in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite, specifically in the API component. This allows a low-privileged attacker with network access via HTTP to compromise the framework, resulting in unauthorized access to critical data or complete access to all accessible data.

Recommendations For versions 8 through 10, consider restricting access to the API component until a patch is available. As a temporary workaround, disabling the vulnerable API endpoint may help minimize the risk of exploitation. Restricting network access via HTTP to the Oracle Enterprise Command Center Framework can also help reduce the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-06889

CVE-2023-22106

Affected Products

Oracle Enterprise Command Center Framework

References · 7

• https://oracle.com/security-alerts/cpuoct2023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22106 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06889 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22106 · Security Note
• https://twitter.com/CVEnew/status/1714390714593743133 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB20231018117 · Note
• https://docs.oracle.com/cd/E26401_01/doc.122/e22956/T27641T671922.htm · Note