PT-2024-7009 · Oracle · Oracle Cost Management+1
Published
2024-10-15
·
Updated
2024-10-21
·
CVE-2024-21267
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Oracle E-Business Suite versions 12.2.12 through 12.2.13
Description
The issue is related to a vulnerability in the Cost Planning component of Oracle Cost Management, which is part of Oracle E-Business Suite. This vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Cost Management accessible data, as well as unauthorized access to critical data or complete access to all Oracle Cost Management accessible data. The vulnerability is easily exploitable and can be accessed remotely using the HTTP protocol.
Recommendations
For versions 12.2.12 through 12.2.13, apply the necessary patches or updates to fix the vulnerability in the Cost Planning component. As a temporary workaround, consider restricting access to the Cost Planning component to minimize the risk of exploitation. Additionally, ensure that input validation is properly implemented to prevent unauthorized data modification or access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Incorrect Authorization
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Oracle Cost Management
Oracle E-Business Suite