CVE-2024-21100: Medium severity oracle commerce vulnerability

Published Apr 16, 2024

Updated

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Platform). Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. While the vulnerability is in Oracle Commerce Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 4.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N).

Affected Software

3 affected components

Oracle Commerce Platform=11.3.0

Oracle Commerce Platform=11.3.1

Oracle Commerce Platform=11.3.2

Event History

Apr 16, 2024

CVE Published

via MITRE·09:26 PM

Data Sourced

via MITRE·09:26 PM

DescriptionSeverity

Data Sourced

via NVD·10:15 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2024-21100?

CVE-2024-21100 is considered a difficult to exploit vulnerability affecting Oracle Commerce Platform.

How do I fix CVE-2024-21100?

To fix CVE-2024-21100, it is recommended to upgrade to the latest supported version of Oracle Commerce Platform.

Which versions of Oracle Commerce Platform are affected by CVE-2024-21100?

CVE-2024-21100 affects Oracle Commerce Platform versions 11.3.0, 11.3.1, and 11.3.2.

Who can exploit CVE-2024-21100?

CVE-2024-21100 can be exploited by an unauthenticated attacker with network access via HTTP.

What component is impacted by CVE-2024-21100?

CVE-2024-21100 impacts the Platform component of the Oracle Commerce product.