PT-2024-4902 · Oracle · Oracle Production Scheduling

Published 2024-04-16 · Updated 2024-11-15 · CVE-2024-21088

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Production Scheduling versions 12.2.4 through 12.2.12

Description: The issue exists due to insufficient input validation in the Import Utility component of Oracle Production Scheduling in Oracle E-Business Suite. This allows a remote attacker to modify, add, or delete data. Successful attacks can result in unauthorized access to critical data or all accessible data in Oracle Production Scheduling.

Recommendations: For versions 12.2.4 through 12.2.12, update to a version that includes the fix for this issue to prevent unauthorized data modification. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-20

CWE-444

Related Identifiers

BDU:2024-05426

CVE-2024-21088

Affected Products

Oracle Production Scheduling

References · 6

• https://bdu.fstec.ru/vul/2024-05426 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21088 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2024.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21088 · Security Note
• https://twitter.com/CVEnew/status/1780349899189416002 · Twitter Post
• https://twitter.com/cracbot/status/1780495282527961374 · Twitter Post