CVE-2024-20916

{"id": "CVE-2024-20916", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.7}]}, "published": "2024-01-16T22:15:39.343", "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2024.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). The supported version that is affected is 13.5.0.0. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Base Platform accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Enterprise Manager Base Platform de Oracle Enterprise Manager (componente: Gesti\u00f3n de eventos). La versi\u00f3n compatible afectada es 13.5.0.0. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante con altos privilegios acceder al segmento de comunicaci\u00f3n f\u00edsica conectado al hardware donde se ejecuta la plataforma base de Oracle Enterprise Manager para comprometer la plataforma base de Oracle Enterprise Manager. Si bien la vulnerabilidad est\u00e1 en la plataforma base de Oracle Enterprise Manager, los ataques pueden afectar significativamente a productos adicionales (scope change). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a la creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n de datos cr\u00edticos o a todos los datos accesibles de la plataforma base de Oracle Enterprise Manager, as\u00ed como acceso no autorizado a datos cr\u00edticos o acceso completo a todos los datos accesibles y capacidades no autorizadas de la plataforma base de Oracle Enterprise Manager. provocar una denegaci\u00f3n parcial de servicio (DOS parcial) de la plataforma base Oracle Enterprise Manager. CVSS 3.1 Puntuaci\u00f3n base 8.3 (impactos en la confidencialidad, la integridad y la disponibilidad). Vector CVSS: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L)."}], "lastModified": "2024-01-20T18:40:50.423", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:enterprise_manager:13.5.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB7E93F6-052B-4D0C-8499-C2CAA920F302"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}