PT-2024-6950 · Oracle · Oracle Hospitality Opera 5

Marcos Díaz Castiñeiras · Published 2024-10-15 · Updated 2024-10-21 · CVE-2024-21172

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Hospitality OPERA 5 versions 5.6.19.19, 5.6.25.8, 5.6.26.4

Description The issue is related to insufficient input validation in the Opera Servlet component, allowing an unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks can result in takeover of the application. While the vulnerability is in Oracle Hospitality OPERA 5, attacks may significantly impact additional products.

Recommendations For version 5.6.19.19, update to a version that fixes the issue. For version 5.6.25.8, update to a version that fixes the issue. For version 5.6.26.4, update to a version that fixes the issue. As a temporary workaround, consider restricting access to the Opera Servlet component until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-08199

CVE-2024-21172

Affected Products

Oracle Hospitality Opera 5

References · 9

• https://osv.dev/vulnerability/CVE-2024-21172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21172 · Security Note
• https://oracle.com/security-alerts/cpuoct2024.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08199 · Security Note
• https://twitter.com/VulmonFeeds/status/1846429496750031255 · Twitter Post
• https://twitter.com/CVEnew/status/1846302646862598654 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB20241015221 · Note
• https://twitter.com/CveFindCom/status/1846280690439991680 · Twitter Post
• https://oracle.com/security-alerts/cpuoct2024.html?904622 · Note