PT-2023-9538 · Oracle · Oracle Process Manufacturing Product Development+1

Published 2023-12-07 · Updated 2024-11-07 · CVE-2024-21250

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle Process Manufacturing Product Development versions 12.2.13 through 12.2.14

Description The issue is related to weaknesses in the authorization procedure of the Quality Manager Specification component in Oracle Process Manufacturing Product Development, part of the Oracle E-Business Suite. This can allow a remote attacker to gain read, modify, or delete access to data via the HTTP protocol. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data within Oracle Process Manufacturing Product Development.

Recommendations For versions 12.2.13 through 12.2.14, apply the necessary patch to fix the vulnerability in the Quality Manager Specification component. As a temporary workaround, consider restricting access to the Quality Manager Specification component until a patch is available. Additionally, limit network access via HTTP to minimize the risk of exploitation.

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

BDU:2024-08297

CVE-2024-21250

Affected Products

Oracle E-Business Suite

Oracle Process Manufacturing Product Development

References · 8

• https://oracle.com/security-alerts/cpuoct2024.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21250 · Security Note
• https://bdu.fstec.ru/vul/2024-08297 · Security Note
• https://twitter.com/UndercodeNews/status/1854370879074877686 · Twitter Post
• https://t.me/cvenotify/100872 · Telegram Post
• https://twitter.com/CVEnew/status/1846284336191918541 · Twitter Post
• https://vuldb.com/?id.280451 · Note