PT-2023-9577 · Oracle · Oracle Mes+1

Published 2023-12-07 · Updated 2024-10-21 · CVE-2024-21277

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.3 through 12.2.13

Description The issue is related to a vulnerability in the Device Integration component of Oracle MES for Process Manufacturing, which can be exploited by a low-privileged attacker with network access via HTTP. This can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data. The vulnerability is easily exploitable and can result in significant confidentiality and integrity impacts.

Recommendations For versions 12.2.3 through 12.2.13, consider restricting access to the Device Integration component until a patch is available. As a temporary workaround, limit the use of HTTP protocol for sensitive operations. Additionally, review and strengthen authorization mechanisms to prevent unauthorized data access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

BDU:2024-08461

CVE-2024-21277

Affected Products

Oracle E-Business Suite

Oracle Mes

References · 8

• https://oracle.com/security-alerts/cpuoct2024.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21277 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08461 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21277 · Security Note
• https://vuldb.com/?id.280463 · Note
• https://t.me/cvenotify/98978 · Telegram Post
• https://twitter.com/CVEnew/status/1846284305233850818 · Twitter Post
• https://t.me/cvedetector/7955 · Telegram Post