CVE-2024-21277: High severity oracle e-business suite vulnerability
Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle MES for Process Manufacturing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle MES for Process Manufacturing accessible data as well as unauthorized access to critical data or complete access to all Oracle MES for Process Manufacturing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21277?
CVE-2024-21277 is considered a critical vulnerability due to its potential for exploitation by low-privileged attackers with network access.
How do I fix CVE-2024-21277?
To fix CVE-2024-21277, upgrade your Oracle E-Business Suite to a version higher than 12.2.13.
What components are affected by CVE-2024-21277?
CVE-2024-21277 affects the Device Integration component of the Oracle MES for Process Manufacturing product within the Oracle E-Business Suite.
Who is vulnerable to CVE-2024-21277?
Organizations using Oracle E-Business Suite versions 12.2.3 to 12.2.13 are vulnerable to CVE-2024-21277.
What type of attack can exploit CVE-2024-21277?
CVE-2024-21277 can be exploited via HTTP by low-privileged attackers to compromise affected systems.