PT-2024-1208 · Oracle · Oracle E-Business Suite+1

Andrej Šimko · Published 2024-01-16 · Updated 2024-11-29 · CVE-2024-20939

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.3 through 12.2.13

Description The issue is related to insufficient input validation in the Admin Console component of Oracle CRM Technical Foundation, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle CRM Technical Foundation.

Recommendations For versions 12.2.3 through 12.2.13, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the Admin Console component to minimize the risk of exploitation. Additionally, ensure that all input data is properly validated to prevent unauthorized actions.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-00595

CVE-2024-20939

Affected Products

Oracle Crm Technical Foundation

Oracle E-Business Suite

References · 10

• https://oracle.com/security-alerts/cpujan2024.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20939 · Security Note
• https://bdu.fstec.ru/vul/2024-00595 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20939 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1758761250161361096 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2024011770 · Note
• https://twitter.com/dailycve/status/1862510698326028493 · Twitter Post
• https://vuldb.com/sv/?id.251077 · Note
• https://twitter.com/CVEnew/status/1758677561117196750 · Twitter Post
• https://oracle.com/security-alerts/cpujan2024verbose.html · Note