CVE-2024-21285: High severity oracle banking liquidity management vulnerability

Published Oct 15, 2024

Updated

Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The supported version that is affected is 14.5.0.12.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Liquidity Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Banking Liquidity Management. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

Affected Software

1 affected component

Oracle Banking Liquidity Management=14.5.0.12.0

Event History

Oct 15, 2024

CVE Published

via MITRE·07:53 PM

Data Sourced

via MITRE·07:53 PM

DescriptionSeverity

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-21285?

CVE-2024-21285 is classified as a low severity vulnerability, making it difficult to exploit.

How do I fix CVE-2024-21285?

To fix CVE-2024-21285, update your Oracle Banking Liquidity Management product to version 14.5.0.12.1 or later.

Who is affected by CVE-2024-21285?

Only users of Oracle Banking Liquidity Management version 14.5.0.12.0 are affected by CVE-2024-21285.

What component of Oracle Financial Services Applications is impacted by CVE-2024-21285?

CVE-2024-21285 impacts the Reports component of the Oracle Banking Liquidity Management product.

Can a low privileged attacker exploit CVE-2024-21285 remotely?

Yes, a low privileged attacker with network access via HTTP can potentially exploit CVE-2024-21285.