CVE-2024-20991: Infoleak

Published Apr 16, 2024

Updated

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HTTP Server accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected Software

1 affected component

Oracle HTTP Server

Event History

Apr 16, 2024

CVE Published

via MITRE·09:25 PM

Data Sourced

via MITRE·09:25 PM

DescriptionSeverity

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-20991?

CVE-2024-20991 is rated as a high severity vulnerability due to its ease of exploitation and potential impact on the Oracle HTTP Server.

How do I fix CVE-2024-20991?

To fix CVE-2024-20991, you should apply the latest security patch provided by Oracle for your version of Oracle HTTP Server.

What products are affected by CVE-2024-20991?

CVE-2024-20991 affects the Oracle HTTP Server within the Oracle Fusion Middleware product suite, specifically version 12.2.1.4.0.

What type of exploitation is possible with CVE-2024-20991?

CVE-2024-20991 allows unauthenticated attackers with network access via HTTP to compromise the Oracle HTTP Server.

Is there a workaround for CVE-2024-20991 if I cannot immediately patch?

While a definitive workaround may not be available, you should restrict network access to the Oracle HTTP Server as a temporary mitigation for CVE-2024-20991.