CVE-2024-20943
First published: Sat Feb 17 2024(Updated: )
Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Knowledge Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Knowledge Management accessible data as well as unauthorized read access to a subset of Oracle Knowledge Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Knowledge Management | >=12.2.3<=12.2.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20943?
CVE-2024-20943 is classified as an easily exploitable vulnerability with a low privilege attack vector.
How do I fix CVE-2024-20943?
To fix CVE-2024-20943, apply the latest security patches from Oracle for Oracle Knowledge Management in versions 12.2.3 to 12.2.13.
Who is affected by CVE-2024-20943?
Organizations using Oracle E-Business Suite with Oracle Knowledge Management versions 12.2.3 to 12.2.13 are affected by CVE-2024-20943.
What impact does CVE-2024-20943 have?
CVE-2024-20943 allows a low privileged attacker to compromise Oracle Knowledge Management through HTTP network access.
When was CVE-2024-20943 disclosed?
CVE-2024-20943 was disclosed as part of Oracle's security alert in January 2024.
- agent/references
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/event
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/oracle
- canonical/oracle knowledge management
- version/oracle knowledge management/12.2.3
- version/oracle knowledge management/12.2.13