CVE-2024-20936

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-20936
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data as well as unauthorized read access to a subset of Oracle One-to-One Fulfillment accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.oracle.com/security-alerts/cpujan2024.html Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:one-to-one_fulfillment:*:*:*:*:*:*:*:*
History

20 Jan 2024, 18:35

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:oracle:one-to-one_fulfillment:*:*:*:*:*:*:*:*
Summary
  • (es) Vulnerabilidad en el producto Oracle One-to-One Fulfilment de Oracle E-Business Suite (componente: Documents). Las versiones compatibles que se ven afectadas son 12.2.3-12.2.13. Una vulnerabilidad fácilmente explotable permite que un atacante no autenticado con acceso a la red a través de HTTP comprometa Oracle One-to-One Fulfilment. Los ataques exitosos requieren la interacción humana de una persona distinta del atacante y, si bien la vulnerabilidad se encuentra en Oracle One-to-One Fulfilment, los ataques pueden afectar significativamente a productos adicionales (scope change). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a actualizaciones, inserción o eliminación de algunos de los datos accesibles de Oracle One-to-One Fulfilment, así como acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle One-to-One Fulfilment. CVSS 3.1 Puntaje base 6.1 (Impactos en la confidencialidad y la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
First Time Oracle
Oracle one-to-one Fulfillment
References () https://www.oracle.com/security-alerts/cpujan2024.html - () https://www.oracle.com/security-alerts/cpujan2024.html - Patch, Vendor Advisory

16 Jan 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-16 22:15

Updated : 2024-01-20 18:35

NVD link : CVE-2024-20936

Mitre link : CVE-2024-20936

CVE.ORG link : CVE-2024-20936

JSON object : View

Products Affected

oracle

  • one-to-one_fulfillment
CWE
NVD-CWE-noinfo