PT-2023-6271 · Oracle · Oracle Commerce Guided Search

Jeffrey Mcclure · Published 2023-10-17 · Updated 2023-10-23 · CVE-2023-22029

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search version 11.3.2

Description The issue is related to insufficient input validation in the Workbench component of Oracle Commerce Guided Search. This easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. Attacks can result in unauthorized update, insert, or delete access to some of Oracle Commerce Guided Search accessible data, as well as unauthorized read access to a subset of Oracle Commerce Guided Search accessible data.

Recommendations For Oracle Commerce Guided Search version 11.3.2, consider restricting access to the Workbench component until a patch is available. As a temporary workaround, limit the use of the vulnerable component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-06981

CVE-2023-22029

Affected Products

Oracle Commerce Guided Search

References · 7

• https://oracle.com/security-alerts/cpuoct2023.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22029 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22029 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06981 · Security Note
• https://t.me/cvenotify/59617 · Telegram Post
• https://twitter.com/CVEnew/status/1714390764795416837 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1714454451245711511 · Twitter Post