Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2024-21190 (GCVE-0-2024-21190)
Vulnerability from cvelistv5 – Published: 2024-10-15 19:52 – Updated: 2024-10-16 14:51
VLAI?
EPSS
Summary
Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Severity ?
7.5 (High)
CWE
- Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data.
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Oracle Corporation | Oracle Global Lifecycle Management FMW Installer |
Affected:
12.2.1.4.0
cpe:2.3:a:oracle:global_lifecycle_management_fmw_installer:12.2.1.4.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21190",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-16T14:48:18.460081Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-16T14:51:01.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oracle:global_lifecycle_management_fmw_installer:12.2.1.4.0:*:*:*:*:*:*:*"
],
"product": "Oracle Global Lifecycle Management FMW Installer",
"vendor": "Oracle Corporation",
"versions": [
{
"status": "affected",
"version": "12.2.1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en-US",
"value": "Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data.",
"lang": "en-US"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T19:52:16.649Z",
"orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"shortName": "oracle"
},
"references": [
{
"name": "Oracle Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"assignerShortName": "oracle",
"cveId": "CVE-2024-21190",
"datePublished": "2024-10-15T19:52:16.649Z",
"dateReserved": "2023-12-07T22:28:10.688Z",
"dateUpdated": "2024-10-16T14:51:01.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-21190\",\"sourceIdentifier\":\"secalert_us@oracle.com\",\"published\":\"2024-10-15T20:15:05.973\",\"lastModified\":\"2024-10-18T18:56:42.630\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad en el producto Oracle Global Lifecycle Management FMW Installer de Oracle Fusion Middleware (componente: Cloning). La versi\u00f3n compatible afectada es la 12.2.1.4.0. Esta vulnerabilidad, que se puede explotar f\u00e1cilmente, permite que un atacante no autenticado con acceso a la red a trav\u00e9s de SFTP ponga en peligro Oracle Global Lifecycle Management FMW Installer. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado la creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n no autorizada de datos cr\u00edticos o de todos los datos accesibles de Oracle Global Lifecycle Management FMW Installer. Puntuaci\u00f3n base de CVSS 3.1: 7,5 (impactos en la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert_us@oracle.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6329B1A2-75A8-4909-B4FB-77AC7232B6ED\"}]}]}],\"references\":[{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2024.html\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-21190\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-16T14:48:18.460081Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-16T14:50:52.831Z\"}}], \"cna\": {\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:oracle:global_lifecycle_management_fmw_installer:12.2.1.4.0:*:*:*:*:*:*:*\"], \"vendor\": \"Oracle Corporation\", \"product\": \"Oracle Global Lifecycle Management FMW Installer\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.2.1.4.0\"}]}], \"references\": [{\"url\": \"https://www.oracle.com/security-alerts/cpuoct2024.html\", \"name\": \"Oracle Advisory\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"description\": \"Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data.\"}]}], \"providerMetadata\": {\"orgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"shortName\": \"oracle\", \"dateUpdated\": \"2024-10-15T19:52:16.649Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-21190\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-16T14:51:01.705Z\", \"dateReserved\": \"2023-12-07T22:28:10.688Z\", \"assignerOrgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"datePublished\": \"2024-10-15T19:52:16.649Z\", \"assignerShortName\": \"oracle\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
WID-SEC-W-2024-3191
Vulnerability from csaf_certbund - Published: 2024-10-15 22:00 - Updated: 2025-09-30 22:00Summary
Oracle Fusion Middleware: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Oracle Fusion Middleware bündelt mehrere Produkte zur Erstellung, Betrieb und Management von intelligenten Business Anwendungen.
Angriff: Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Betroffene Betriebssysteme: - Sonstiges
References
| URL | Category | |
|---|---|---|
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Oracle Fusion Middleware b\u00fcndelt mehrere Produkte zur Erstellung, Betrieb und Management von intelligenten Business Anwendungen.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-3191 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3191.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-3191 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3191"
},
{
"category": "external",
"summary": "Oracle Critical Patch Update Advisory - October 2024 - Appendix Oracle Fusion Middleware vom 2024-10-15",
"url": "https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixFMW"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7175917 vom 2025-02-28",
"url": "https://www.ibm.com/support/pages/node/7175917"
},
{
"category": "external",
"summary": "cPanel 132 Change Log vom 2025-10-01",
"url": "https://docs.cpanel.net/changelogs/132-change-log/"
}
],
"source_lang": "en-US",
"title": "Oracle Fusion Middleware: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-09-30T22:00:00.000+00:00",
"generator": {
"date": "2025-10-01T06:52:12.370+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.4.0"
}
},
"id": "WID-SEC-W-2024-3191",
"initial_release_date": "2024-10-15T22:00:00.000+00:00",
"revision_history": [
{
"date": "2024-10-15T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-03-02T23:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2025-09-30T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates aufgenommen"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "IBM FileNet Content Manager",
"product": {
"name": "IBM FileNet Content Manager",
"product_id": "T025993",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:filenet_content_manager:-"
}
}
}
],
"category": "vendor",
"name": "IBM"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "11.1.1.5.0",
"product": {
"name": "Oracle Fusion Middleware 11.1.1.5.0",
"product_id": "150102",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:fusion_middleware:11.1.1.5.0"
}
}
},
{
"category": "product_version",
"name": "12.2.1.3.0",
"product": {
"name": "Oracle Fusion Middleware 12.2.1.3.0",
"product_id": "618028",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:fusion_middleware:12.2.1.3.0"
}
}
},
{
"category": "product_version",
"name": "12.2.1.4.0",
"product": {
"name": "Oracle Fusion Middleware 12.2.1.4.0",
"product_id": "751674",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:fusion_middleware:12.2.1.4.0"
}
}
},
{
"category": "product_version",
"name": "14.1.1.0.0",
"product": {
"name": "Oracle Fusion Middleware 14.1.1.0.0",
"product_id": "829576",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:fusion_middleware:14.1.1.0.0"
}
}
},
{
"category": "product_version",
"name": "8.5.7",
"product": {
"name": "Oracle Fusion Middleware 8.5.7",
"product_id": "T034057",
"product_identification_helper": {
"cpe": "cpe:/a:oracle:fusion_middleware:8.5.7"
}
}
}
],
"category": "product_name",
"name": "Fusion Middleware"
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c132.0.0",
"product": {
"name": "cPanel cPanel/WHM \u003c132.0.0",
"product_id": "T047273"
}
},
{
"category": "product_version",
"name": "132.0.0",
"product": {
"name": "cPanel cPanel/WHM 132.0.0",
"product_id": "T047273-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:cpanel:cpanel_whm:132.0.0"
}
}
}
],
"category": "product_name",
"name": "cPanel/WHM"
}
],
"category": "vendor",
"name": "cPanel"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11023",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2020-11023"
},
{
"cve": "CVE-2020-17521",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2020-17521"
},
{
"cve": "CVE-2023-35116",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2023-35116"
},
{
"cve": "CVE-2023-39743",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2023-39743"
},
{
"cve": "CVE-2023-4759",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2023-4759"
},
{
"cve": "CVE-2023-51775",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2023-51775"
},
{
"cve": "CVE-2024-21190",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-21190"
},
{
"cve": "CVE-2024-21191",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-21191"
},
{
"cve": "CVE-2024-21192",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-21192"
},
{
"cve": "CVE-2024-21205",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-21205"
},
{
"cve": "CVE-2024-21215",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-21215"
},
{
"cve": "CVE-2024-21216",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-21216"
},
{
"cve": "CVE-2024-21234",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-21234"
},
{
"cve": "CVE-2024-21246",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-21246"
},
{
"cve": "CVE-2024-21260",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-21260"
},
{
"cve": "CVE-2024-21274",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-21274"
},
{
"cve": "CVE-2024-22201",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-22201"
},
{
"cve": "CVE-2024-22262",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-22262"
},
{
"cve": "CVE-2024-23807",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-23807"
},
{
"cve": "CVE-2024-24549",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-24549"
},
{
"cve": "CVE-2024-2511",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-2511"
},
{
"cve": "CVE-2024-25269",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-25269"
},
{
"cve": "CVE-2024-28182",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-28182"
},
{
"cve": "CVE-2024-28752",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-28752"
},
{
"cve": "CVE-2024-29131",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-29131"
},
{
"cve": "CVE-2024-36052",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-36052"
},
{
"cve": "CVE-2024-38999",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-38999"
},
{
"cve": "CVE-2024-45492",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-45492"
},
{
"cve": "CVE-2024-6345",
"product_status": {
"known_affected": [
"T047273",
"150102",
"T025993",
"618028",
"751674",
"T034057",
"829576"
]
},
"release_date": "2024-10-15T22:00:00.000+00:00",
"title": "CVE-2024-6345"
}
]
}
NCSC-2024-0417
Vulnerability from csaf_ncscnl - Published: 2024-10-17 13:19 - Updated: 2024-10-17 13:19Summary
Kwetsbaarheden verholpen in Oracle Fusion Middleware
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft kwetsbaarheden verholpen in Fusion Middleware componenten, zoals WebLogic Server, WebCenter en HTTP Server.
Interpretaties: Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Manipuleren van data
- Uitvoer van willekeurige code (Administratorrechten)
- Toegang tot gevoelige gegevens
Omdat deze kwetsbaarheden zich bevinden in diverse Middleware producten, is niet uit te sluiten dat applicaties, draaiende op platformen ondersteund door deze middleware ook kwetsbaar zijn, danwel gevoelig voor misbruik van deze kwetsbaarheden.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer infomatie.
Kans: medium
Schade: high
CWE-1325: Improperly Controlled Sequential Memory Allocation
CWE-390: Detection of Error Condition Without Action
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-178: Improper Handling of Case Sensitivity
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CWE-190: Integer Overflow or Wraparound
CWE-404: Improper Resource Shutdown or Release
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-416: Use After Free
CWE-401: Missing Release of Memory after Effective Lifetime
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-502: Deserialization of Untrusted Data
CWE-918: Server-Side Request Forgery (SSRF)
CWE-787: Out-of-bounds Write
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-20: Improper Input Validation
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.9 (Medium)
5.5 (Medium)
CWE-502
- Deserialization of Untrusted Data
8.8 (High)
7.1 (High)
7.5 (High)
7.5 (High)
CWE-94
- Improper Control of Generation of Code ('Code Injection')
9.8 (Critical)
7.5 (High)
8.1 (High)
8.1 (High)
7.5 (High)
7.5 (High)
7.5 (High)
9.3 (Critical)
7.3 (High)
10.0 (Critical)
9.8 (Critical)
References
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft kwetsbaarheden verholpen in Fusion Middleware componenten, zoals WebLogic Server, WebCenter en HTTP Server.",
"title": "Feiten"
},
{
"category": "description",
"text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service (DoS)\n- Manipuleren van data\n- Uitvoer van willekeurige code (Administratorrechten)\n- Toegang tot gevoelige gegevens\n\nOmdat deze kwetsbaarheden zich bevinden in diverse Middleware producten, is niet uit te sluiten dat applicaties, draaiende op platformen ondersteund door deze middleware ook kwetsbaar zijn, danwel gevoelig voor misbruik van deze kwetsbaarheden.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer infomatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improperly Controlled Sequential Memory Allocation",
"title": "CWE-1325"
},
{
"category": "general",
"text": "Detection of Error Condition Without Action",
"title": "CWE-390"
},
{
"category": "general",
"text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"title": "CWE-59"
},
{
"category": "general",
"text": "Improper Handling of Case Sensitivity",
"title": "CWE-178"
},
{
"category": "general",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
},
{
"category": "general",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "general",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "general",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference - cveprojectv5; hkcert; nvd; oracle; redhat",
"url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
}
],
"title": "Kwetsbaarheden verholpen in Oracle Fusion Middleware",
"tracking": {
"current_release_date": "2024-10-17T13:19:16.185510Z",
"id": "NCSC-2024-0417",
"initial_release_date": "2024-10-17T13:19:16.185510Z",
"revision_history": [
{
"date": "2024-10-17T13:19:16.185510Z",
"number": "0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "outside_in_technology",
"product": {
"name": "outside_in_technology",
"product_id": "CSAFPID-292093",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "outside_in_technology",
"product": {
"name": "outside_in_technology",
"product_id": "CSAFPID-1260",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:outside_in_technology:8.5.6:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "outside_in_technology",
"product": {
"name": "outside_in_technology",
"product_id": "CSAFPID-912053",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server_proxy_plug-in",
"product": {
"name": "weblogic_server_proxy_plug-in",
"product_id": "CSAFPID-199883",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server_proxy_plug-in",
"product": {
"name": "weblogic_server_proxy_plug-in",
"product_id": "CSAFPID-951239",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764797",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_console___12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764799",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_console___12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764801",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_console___14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764798",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_third_party___12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764800",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_third_party___12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764802",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_third_party___14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-113536",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:10.3.6.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-113521",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-3663",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-94310",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-3661",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-3660",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-1504444",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-1973",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_content",
"product": {
"name": "webcenter_content",
"product_id": "CSAFPID-389123",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_content:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_content",
"product": {
"name": "webcenter_content",
"product_id": "CSAFPID-179795",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_enterprise_capture",
"product": {
"name": "webcenter_enterprise_capture",
"product_id": "CSAFPID-912594",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_enterprise_capture:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_forms_recognition",
"product": {
"name": "webcenter_forms_recognition",
"product_id": "CSAFPID-1673476",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_forms_recognition:14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_portal",
"product": {
"name": "webcenter_portal",
"product_id": "CSAFPID-135359",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_portal",
"product": {
"name": "webcenter_portal",
"product_id": "CSAFPID-45194",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_sites_support_tools",
"product": {
"name": "webcenter_sites_support_tools",
"product_id": "CSAFPID-765268",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_sites_support_tools:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_sites",
"product": {
"name": "webcenter_sites",
"product_id": "CSAFPID-9026",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_sites",
"product": {
"name": "webcenter_sites",
"product_id": "CSAFPID-135354",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_sites",
"product": {
"name": "webcenter_sites",
"product_id": "CSAFPID-765390",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_sites:all_supported_s:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "data_integrator",
"product": {
"name": "data_integrator",
"product_id": "CSAFPID-204494",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "data_integrator",
"product": {
"name": "data_integrator",
"product_id": "CSAFPID-204566",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "business_activity_monitoring__bam_",
"product": {
"name": "business_activity_monitoring__bam_",
"product_id": "CSAFPID-764927",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:business_activity_monitoring__bam_:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "business_activity_monitoring__bam_",
"product": {
"name": "business_activity_monitoring__bam_",
"product_id": "CSAFPID-764928",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:business_activity_monitoring__bam_:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "business_activity_monitoring",
"product": {
"name": "business_activity_monitoring",
"product_id": "CSAFPID-228157",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "business_process_management_suite",
"product": {
"name": "business_process_management_suite",
"product_id": "CSAFPID-9043",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "business_process_management_suite",
"product": {
"name": "business_process_management_suite",
"product_id": "CSAFPID-9642",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "middleware_common_libraries_and_tools",
"product": {
"name": "middleware_common_libraries_and_tools",
"product_id": "CSAFPID-94398",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "middleware_common_libraries_and_tools",
"product": {
"name": "middleware_common_libraries_and_tools",
"product_id": "CSAFPID-94309",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "middleware_common_libraries_and_tools",
"product": {
"name": "middleware_common_libraries_and_tools",
"product_id": "CSAFPID-94393",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "enterprise_manager_fusion_middleware_control",
"product": {
"name": "enterprise_manager_fusion_middleware_control",
"product_id": "CSAFPID-1673426",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:enterprise_manager_fusion_middleware_control:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "global_lifecycle_management_fmw_installer",
"product": {
"name": "global_lifecycle_management_fmw_installer",
"product_id": "CSAFPID-1673425",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:global_lifecycle_management_fmw_installer:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "http_server",
"product": {
"name": "http_server",
"product_id": "CSAFPID-93909",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "http_server",
"product": {
"name": "http_server",
"product_id": "CSAFPID-40303",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "http_server",
"product": {
"name": "http_server",
"product_id": "CSAFPID-912074",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:http_server:14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "managed_file_transfer",
"product": {
"name": "managed_file_transfer",
"product_id": "CSAFPID-204452",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "managed_file_transfer",
"product": {
"name": "managed_file_transfer",
"product_id": "CSAFPID-204581",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "identity_manager_connector",
"product": {
"name": "identity_manager_connector",
"product_id": "CSAFPID-765382",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:identity_manager_connector:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "identity_manager_connector",
"product": {
"name": "identity_manager_connector",
"product_id": "CSAFPID-227776",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "identity_manager_connector",
"product": {
"name": "identity_manager_connector",
"product_id": "CSAFPID-396523",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:identity_manager_connector:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "identity_manager_connector",
"product": {
"name": "identity_manager_connector",
"product_id": "CSAFPID-204638",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:identity_manager_connector:9.1.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "identity_manager_connector",
"product": {
"name": "identity_manager_connector",
"product_id": "CSAFPID-765267",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:identity_manager_connector:9.1.0.0.0:*:*:*:*:*:*:*"
}
}
}
],
"category": "vendor",
"name": "oracle"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11023",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-135354",
"CSAFPID-9026",
"CSAFPID-3663",
"CSAFPID-3661",
"CSAFPID-94310",
"CSAFPID-113521",
"CSAFPID-113536",
"CSAFPID-9642",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-204581",
"CSAFPID-94309",
"CSAFPID-1260",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-204494",
"CSAFPID-93909",
"CSAFPID-765267",
"CSAFPID-204452",
"CSAFPID-94398",
"CSAFPID-389123",
"CSAFPID-135359",
"CSAFPID-765268"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2020-11023",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-11023.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-135354",
"CSAFPID-9026",
"CSAFPID-3663",
"CSAFPID-3661",
"CSAFPID-94310",
"CSAFPID-113521",
"CSAFPID-113536",
"CSAFPID-9642",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-204581",
"CSAFPID-94309",
"CSAFPID-1260",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-204494",
"CSAFPID-93909",
"CSAFPID-765267",
"CSAFPID-204452",
"CSAFPID-94398",
"CSAFPID-389123",
"CSAFPID-135359",
"CSAFPID-765268"
]
}
],
"title": "CVE-2020-11023"
},
{
"cve": "CVE-2020-17521",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
}
],
"product_status": {
"known_affected": [
"CSAFPID-9642",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-396523",
"CSAFPID-204638",
"CSAFPID-94309",
"CSAFPID-179795",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973",
"CSAFPID-204581",
"CSAFPID-1260",
"CSAFPID-45194",
"CSAFPID-764797",
"CSAFPID-764798",
"CSAFPID-3661",
"CSAFPID-764799",
"CSAFPID-764800",
"CSAFPID-764801",
"CSAFPID-764802",
"CSAFPID-764927",
"CSAFPID-764928",
"CSAFPID-9043",
"CSAFPID-93909",
"CSAFPID-94398",
"CSAFPID-389123",
"CSAFPID-135359",
"CSAFPID-9026",
"CSAFPID-204494",
"CSAFPID-765267",
"CSAFPID-204452",
"CSAFPID-765268",
"CSAFPID-227776",
"CSAFPID-94310",
"CSAFPID-765382",
"CSAFPID-292093",
"CSAFPID-94393",
"CSAFPID-765390"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2020-17521",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-17521.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-9642",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-396523",
"CSAFPID-204638",
"CSAFPID-94309",
"CSAFPID-179795",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973",
"CSAFPID-204581",
"CSAFPID-1260",
"CSAFPID-45194",
"CSAFPID-764797",
"CSAFPID-764798",
"CSAFPID-3661",
"CSAFPID-764799",
"CSAFPID-764800",
"CSAFPID-764801",
"CSAFPID-764802",
"CSAFPID-764927",
"CSAFPID-764928",
"CSAFPID-9043",
"CSAFPID-93909",
"CSAFPID-94398",
"CSAFPID-389123",
"CSAFPID-135359",
"CSAFPID-9026",
"CSAFPID-204494",
"CSAFPID-765267",
"CSAFPID-204452",
"CSAFPID-765268",
"CSAFPID-227776",
"CSAFPID-94310",
"CSAFPID-765382",
"CSAFPID-292093",
"CSAFPID-94393",
"CSAFPID-765390"
]
}
],
"title": "CVE-2020-17521"
},
{
"cve": "CVE-2022-1471",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"product_status": {
"known_affected": [
"CSAFPID-9642",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-204581",
"CSAFPID-94309",
"CSAFPID-1260",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-3661",
"CSAFPID-3660",
"CSAFPID-1973",
"CSAFPID-396523",
"CSAFPID-204638",
"CSAFPID-135354",
"CSAFPID-764797",
"CSAFPID-764798",
"CSAFPID-764799",
"CSAFPID-764800",
"CSAFPID-764801",
"CSAFPID-764802",
"CSAFPID-199883",
"CSAFPID-912074",
"CSAFPID-94393",
"CSAFPID-912053",
"CSAFPID-912594",
"CSAFPID-951239"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-1471",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-1471.json"
}
],
"title": "CVE-2022-1471"
},
{
"cve": "CVE-2023-4759",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"title": "CWE-59"
},
{
"category": "other",
"text": "Improper Handling of Case Sensitivity",
"title": "CWE-178"
}
],
"product_status": {
"known_affected": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-4759",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4759.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2023-4759"
},
{
"cve": "CVE-2023-35116",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
}
],
"product_status": {
"known_affected": [
"CSAFPID-9642",
"CSAFPID-40303",
"CSAFPID-1260",
"CSAFPID-45194",
"CSAFPID-3661",
"CSAFPID-3660",
"CSAFPID-1973",
"CSAFPID-199883",
"CSAFPID-951239",
"CSAFPID-94309",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-94393",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-228157",
"CSAFPID-135354"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-35116",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-35116.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-9642",
"CSAFPID-40303",
"CSAFPID-1260",
"CSAFPID-45194",
"CSAFPID-3661",
"CSAFPID-3660",
"CSAFPID-1973",
"CSAFPID-199883",
"CSAFPID-951239",
"CSAFPID-94309",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-94393",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-228157",
"CSAFPID-135354"
]
}
],
"title": "CVE-2023-35116"
},
{
"cve": "CVE-2023-39743",
"product_status": {
"known_affected": [
"CSAFPID-912053"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-39743",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39743.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-912053"
]
}
],
"title": "CVE-2023-39743"
},
{
"cve": "CVE-2023-51775",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-199883",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-51775",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-51775.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-199883",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
}
],
"title": "CVE-2023-51775"
},
{
"cve": "CVE-2024-2511",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "other",
"text": "Improperly Controlled Sequential Memory Allocation",
"title": "CWE-1325"
}
],
"product_status": {
"known_affected": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-2511",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2511.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-2511"
},
{
"cve": "CVE-2024-6345",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-6345",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-6345.json"
}
],
"title": "CVE-2024-6345"
},
{
"cve": "CVE-2024-21190",
"product_status": {
"known_affected": [
"CSAFPID-1673425"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21190",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21190.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1673425"
]
}
],
"title": "CVE-2024-21190"
},
{
"cve": "CVE-2024-21191",
"product_status": {
"known_affected": [
"CSAFPID-1673426"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21191",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21191.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1673426"
]
}
],
"title": "CVE-2024-21191"
},
{
"cve": "CVE-2024-21192",
"references": [
{
"category": "self",
"summary": "CVE-2024-21192",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21192.json"
}
],
"title": "CVE-2024-21192"
},
{
"cve": "CVE-2024-21205",
"references": [
{
"category": "self",
"summary": "CVE-2024-21205",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21205.json"
}
],
"title": "CVE-2024-21205"
},
{
"cve": "CVE-2024-21215",
"product_status": {
"known_affected": [
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21215",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21215.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-21215"
},
{
"cve": "CVE-2024-21216",
"product_status": {
"known_affected": [
"CSAFPID-1973",
"CSAFPID-3660"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21216",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21216.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1973",
"CSAFPID-3660"
]
}
],
"title": "CVE-2024-21216"
},
{
"cve": "CVE-2024-21234",
"product_status": {
"known_affected": [
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21234",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21234.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-21234"
},
{
"cve": "CVE-2024-21246",
"references": [
{
"category": "self",
"summary": "CVE-2024-21246",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21246.json"
}
],
"title": "CVE-2024-21246"
},
{
"cve": "CVE-2024-21260",
"product_status": {
"known_affected": [
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21260",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21260.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-21260"
},
{
"cve": "CVE-2024-21274",
"product_status": {
"known_affected": [
"CSAFPID-1973",
"CSAFPID-3660"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21274",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21274.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1973",
"CSAFPID-3660"
]
}
],
"title": "CVE-2024-21274"
},
{
"cve": "CVE-2024-22201",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
}
],
"product_status": {
"known_affected": [
"CSAFPID-199883",
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-22201",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22201.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-199883",
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
}
],
"title": "CVE-2024-22201"
},
{
"cve": "CVE-2024-22262",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"notes": [
{
"category": "other",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1673476",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-22262",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22262.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1673476",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-22262"
},
{
"cve": "CVE-2024-23807",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
}
],
"product_status": {
"known_affected": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-23807",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-23807.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-23807"
},
{
"cve": "CVE-2024-24549",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"product_status": {
"known_affected": [
"CSAFPID-199883",
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-24549",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24549.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-199883",
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
}
],
"title": "CVE-2024-24549"
},
{
"cve": "CVE-2024-25269",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "other",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
}
],
"product_status": {
"known_affected": [
"CSAFPID-912053"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-25269",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-25269.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-912053"
]
}
],
"title": "CVE-2024-25269"
},
{
"cve": "CVE-2024-28182",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "other",
"text": "Detection of Error Condition Without Action",
"title": "CWE-390"
},
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
}
],
"product_status": {
"known_affected": [
"CSAFPID-912074",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-28182",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-28182.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-912074",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-28182"
},
{
"cve": "CVE-2024-28752",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1673476",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-28752",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-28752.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1673476",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-28752"
},
{
"cve": "CVE-2024-29131",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"product_status": {
"known_affected": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-29131",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29131.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-29131"
},
{
"cve": "CVE-2024-36052",
"product_status": {
"known_affected": [
"CSAFPID-912053"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-36052",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-36052.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-912053"
]
}
],
"title": "CVE-2024-36052"
},
{
"cve": "CVE-2024-38999",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
}
],
"product_status": {
"known_affected": [
"CSAFPID-9642",
"CSAFPID-228157"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-38999",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38999.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-9642",
"CSAFPID-228157"
]
}
],
"title": "CVE-2024-38999"
},
{
"cve": "CVE-2024-45492",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
}
],
"product_status": {
"known_affected": [
"CSAFPID-912053"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-45492",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-45492.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-912053"
]
}
],
"title": "CVE-2024-45492"
}
]
}
GHSA-7X8F-79RH-QG88
Vulnerability from github – Published: 2024-10-15 21:30 – Updated: 2024-10-15 21:30
VLAI?
Details
Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Severity ?
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-21190"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-15T20:15:05Z",
"severity": "HIGH"
},
"details": "Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).",
"id": "GHSA-7x8f-79rh-qg88",
"modified": "2024-10-15T21:30:37Z",
"published": "2024-10-15T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21190"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GSD-2024-21190
Vulnerability from gsd - Updated: 2023-12-13 01:21Details
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2024-21190",
"id": "GSD-2024-21190"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2024-21190"
],
"id": "GSD-2024-21190",
"modified": "2023-12-13T01:21:42.707258Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2024-21190",
"STATE": "RESERVED"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}
}
}
BDU:2024-08343
Vulnerability from fstec - Published: 15.10.2024
VLAI Severity ?
Title
Уязвимость компонента Cloning программного средства Oracle Global Lifecycle Management FMW Installer программной платформы Oracle Fusion Middleware, позволяющая нарушителю получить доступ на изменение, добавление и удаление данных
Description
Уязвимость компонента Cloning программного средства Oracle Global Lifecycle Management FMW Installer программной платформы Oracle Fusion Middleware связана с недостаточной проверкой входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ на изменение, добавление и удаление данных
Severity ?
Vendor
Oracle Corp.
Software Name
Oracle Global Lifecycle Management FMW Installer
Software Version
12.2.1.4.0 (Oracle Global Lifecycle Management FMW Installer)
Possible Mitigations
Использование рекомендаций производителя:
https://www.oracle.com/security-alerts/cpuoct2024.html?904622
Reference
https://www.oracle.com/security-alerts/cpuoct2024.html?904622
https://www.cybersecurity-help.cz/vdb/SB20241015161
CWE
CWE-20
{
"CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:C/A:N",
"CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Oracle Corp.",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "12.2.1.4.0 (Oracle Global Lifecycle Management FMW Installer)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.oracle.com/security-alerts/cpuoct2024.html?904622",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "15.10.2024",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.10.2024",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "23.10.2024",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-08343",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-21190",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Oracle Global Lifecycle Management FMW Installer",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Cloning \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 Oracle Global Lifecycle Management FMW Installer \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Oracle Fusion Middleware, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0430 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Cloning \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 Oracle Global Lifecycle Management FMW Installer \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Oracle Fusion Middleware \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0430 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.oracle.com/security-alerts/cpuoct2024.html?904622\nhttps://www.cybersecurity-help.cz/vdb/SB20241015161",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}
FKIE_CVE-2024-21190
Vulnerability from fkie_nvd - Published: 2024-10-15 20:15 - Updated: 2024-10-18 18:56
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
References
| URL | Tags | ||
|---|---|---|---|
| secalert_us@oracle.com | https://www.oracle.com/security-alerts/cpuoct2024.html | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| oracle | fusion_middleware | 12.2.1.4.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6329B1A2-75A8-4909-B4FB-77AC7232B6ED",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)."
},
{
"lang": "es",
"value": "Vulnerabilidad en el producto Oracle Global Lifecycle Management FMW Installer de Oracle Fusion Middleware (componente: Cloning). La versi\u00f3n compatible afectada es la 12.2.1.4.0. Esta vulnerabilidad, que se puede explotar f\u00e1cilmente, permite que un atacante no autenticado con acceso a la red a trav\u00e9s de SFTP ponga en peligro Oracle Global Lifecycle Management FMW Installer. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado la creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n no autorizada de datos cr\u00edticos o de todos los datos accesibles de Oracle Global Lifecycle Management FMW Installer. Puntuaci\u00f3n base de CVSS 3.1: 7,5 (impactos en la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)."
}
],
"id": "CVE-2024-21190",
"lastModified": "2024-10-18T18:56:42.630",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "secalert_us@oracle.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-10-15T20:15:05.973",
"references": [
{
"source": "secalert_us@oracle.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
}
],
"sourceIdentifier": "secalert_us@oracle.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…