PT-2024-3074 · Oracle · Oracle Enterprise Manager Base Platform

Ben Leonard-Lagarde · Published 2024-04-16 · Updated 2024-08-15 · CVE-2024-21067

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5.0.0

Description The issue is related to insufficient input validation in the Host Management component of the Oracle Enterprise Manager Base Platform. This allows a low-privileged attacker with logon access to the infrastructure where the platform executes to compromise it. Successful attacks can result in the takeover of the Oracle Enterprise Manager Base Platform and may significantly impact additional products.

Recommendations For version 13.5.0.0, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

RCE

Weakness Enumeration

CWE-284

CWE-20

Related Identifiers

BDU:2024-03267

CVE-2024-21067

Affected Products

Oracle Enterprise Manager Base Platform

References · 10

• https://osv.dev/vulnerability/CVE-2024-21067 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2024.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03267 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21067 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-04-19.1.pdf · Security Note
• https://twitter.com/VulmonFeeds/status/1780397732605100163 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2024041701 · Note
• https://twitter.com/cracbot/status/1780495255290122439 · Twitter Post
• https://twitter.com/CVEnew/status/1780349926741885360 · Twitter Post
• https://t.me/cvenotify/90765 · Telegram Post