PT-2023-9067 · Oracle · Oracle Hospitality Simphony

Published 2023-12-07 · Updated 2024-11-27 · CVE-2024-21014

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Simphony versions 19.1.0 through 19.5.4

Description The issue is related to insufficient input validation in the Simphony Enterprise Server component. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony, potentially resulting in a takeover. The estimated number of potentially affected devices is not specified.

Recommendations For versions 19.1.0 through 19.5.4, update to a version that addresses this issue, as the current version allows for easy exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

RCE

Weakness Enumeration

CWE-306

CWE-20

Related Identifiers

BDU:2024-03398

CVE-2024-21014

Affected Products

Oracle Hospitality Simphony

References · 9

• https://bdu.fstec.ru/vul/2024-03398 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-04-19.1.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21014 · Security Note
• https://oracle.com/security-alerts/cpuapr2024.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21014 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2024041749 · Note
• https://twitter.com/CVEnew/status/1780363497483976797 · Twitter Post
• https://vuldb.com/ru/?id.261086 · Note
• https://twitter.com/cracbot/status/1780495250315760111 · Twitter Post