CVE-2024-21261: Medium severity oracle application express vulnerability
Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23.2 and 24.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express. While the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express accessible data as well as unauthorized read access to a subset of Oracle Application Express accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21261?
CVE-2024-21261 is classified as a difficult to exploit vulnerability affecting Oracle Application Express versions 23.2 and 24.1.
How do I fix CVE-2024-21261?
To mitigate CVE-2024-21261, Oracle recommends upgrading to the latest version of Oracle Application Express that is not affected.
Who is affected by CVE-2024-21261?
CVE-2024-21261 affects users of Oracle Application Express versions 23.2 and 24.1 with network access.
Can CVE-2024-21261 be exploited easily?
CVE-2024-21261 is considered difficult to exploit, requiring low privileged attackers with HTTP network access.
What component is involved in CVE-2024-21261?
CVE-2024-21261 involves a vulnerability in the General component of Oracle Application Express.