PT-2024-7083 · Oracle · Oracle Global Lifecycle Management Fmw Installer

4Ra1N + 1 · Published 2024-10-15 · Updated 2024-10-18 · CVE-2024-21190

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle Global Lifecycle Management FMW Installer version 12.2.1.4.0

Description The issue is related to insufficient input validation in the Cloning component of the Oracle Global Lifecycle Management FMW Installer product. This allows an unauthenticated attacker with network access via SFTP to compromise the Oracle Global Lifecycle Management FMW Installer. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all accessible data.

Recommendations For version 12.2.1.4.0, consider restricting access to the Cloning component until a patch is available. As a temporary workaround, limit network access via SFTP to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-08343

CVE-2024-21190

Affected Products

Oracle Global Lifecycle Management Fmw Installer

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-21190 · Security Note
• https://oracle.com/security-alerts/cpuoct2024.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21190 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08343 · Security Note
• https://t.me/cvenotify/98807 · Telegram Post
• https://t.me/cvenotify/98760 · Telegram Post
• https://oracle.com/security-alerts/cpuoct2024.html?904622 · Note
• https://cybersecurity-help.cz/vdb/SB20241015161 · Note
• https://twitter.com/CVEnew/status/1846302645767884835 · Twitter Post