PT-2023-9573 · Oracle · Oracle E-Business Suite

Published 2023-12-07 · Updated 2024-10-21 · CVE-2024-21282

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.3 through 12.2.13

Description The issue is related to weaknesses in the authorization mechanism of the Common Components component in Oracle Financials, part of the Oracle E-Business Suite. This can allow a remote attacker to gain unauthorized access to create, modify, or delete data using the HTTP protocol. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Financials accessible data.

Recommendations For versions 12.2.3 through 12.2.13, consider restricting access to the vulnerable component until a patch is available. As a temporary workaround, limit network access via HTTP to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-20

CWE-863

CWE-285

Related Identifiers

BDU:2024-08455

CVE-2024-21282

Affected Products

Oracle E-Business Suite

References · 9

• https://bdu.fstec.ru/vul/2024-08455 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21282 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2024.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21282 · Security Note
• https://vuldb.com/ru/?id.280467 · Note
• https://twitter.com/CVEnew/status/1846284298938171544 · Twitter Post
• https://t.me/cvenotify/98992 · Telegram Post
• https://t.me/cvedetector/7952 · Telegram Post
• https://docs.oracle.com/cd/E18727-01/doc.121/e13424/T433149T433152.htm · Note