PT-2024-1209 · Oracle · Oracle E-Business Suite+1
Andrej Šimko
·
Published
2024-01-16
·
Updated
2025-03-18
·
CVE-2024-20941
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Oracle E-Business Suite versions 12.2.3 through 12.2.13
Description
The issue is related to insufficient input validation in the HTML UI component of Oracle Installed Base, allowing an unauthenticated attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. Attacks can result in unauthorized update, insert, or delete access to some of Oracle Installed Base accessible data, as well as unauthorized read access to a subset of Oracle Installed Base accessible data.
Recommendations
For versions 12.2.3 through 12.2.13, consider disabling the HTML UI component temporarily until a patch is available to prevent exploitation. Restrict access to the Oracle Installed Base product via HTTP to minimize the risk of unauthorized data access. Apply configuration changes to limit the impact of potential attacks, such as restricting user privileges and monitoring network activity for suspicious behavior. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Out of bounds Read
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Oracle E-Business Suite
Oracle Installed Base