CVE-2024-20941
First published: Sat Feb 17 2024(Updated: )
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: HTML UI). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Installed Base accessible data as well as unauthorized read access to a subset of Oracle Installed Base accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Installed Base | >=12.2.3<=12.2.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20941?
CVE-2024-20941 is categorized as an easily exploitable vulnerability that allows unauthenticated attackers to compromise Oracle Installed Base.
How do I fix CVE-2024-20941?
To fix CVE-2024-20941, it is recommended to upgrade Oracle Installed Base to a patched version outside the affected range of 12.2.3 to 12.2.13.
Who is affected by CVE-2024-20941?
CVE-2024-20941 affects users of Oracle E-Business Suite with versions 12.2.3 through 12.2.13 of the Oracle Installed Base component.
What type of attacker can exploit CVE-2024-20941?
CVE-2024-20941 can be exploited by unauthenticated attackers with network access via HTTP.
What product does CVE-2024-20941 pertain to?
CVE-2024-20941 pertains to the Oracle Installed Base product of the Oracle E-Business Suite.
- agent/references
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/event
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/oracle
- canonical/oracle installed base
- version/oracle installed base/12.2.3
- version/oracle installed base/12.2.13