CVE-2024-20956

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). Supported versions that are affected are Prior to 6.2.4.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujan2024.html	Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2024.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-02-17 02:15

Updated : 2024-11-27 16:37

NVD link : CVE-2024-20956

Mitre link : CVE-2024-20956

CVE.ORG link : CVE-2024-20956

JSON object : View

Products Affected

oracle

agile_product_lifecycle_management_for_process

CWE

NVD-CWE-noinfo

{"id": "CVE-2024-20956", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2024-02-17T02:15:49.680", "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2024.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "https://www.oracle.com/security-alerts/cpujan2024.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). Supported versions that are affected are Prior to 6.2.4.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Agile Product Lifecycle Management for Process de Oracle Supply Chain (componente: Instalaci\u00f3n). Las versiones compatibles que se ven afectadas son anteriores a 6.2.4.2. Una vulnerabilidad f\u00e1cilmente explotable permite que un atacante no autenticado con acceso a la red a trav\u00e9s de HTTP comprometa Oracle Agile Product Lifecycle Management for Process. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado una actualizaci\u00f3n, inserci\u00f3n o eliminaci\u00f3n no autorizada del acceso a algunos de los datos accesibles de Oracle Agile Product Lifecycle Management for Process, as\u00ed como acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle Agile Product Lifecycle Management for Process y capacidad no autorizada para provocar una denegaci\u00f3n de servicio parcial (DOS parcial) de Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Puntuaci\u00f3n base 7.3 (impactos en la confidencialidad, la integridad y la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)."}], "lastModified": "2024-11-27T16:37:04.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFE84C0A-5AC9-4066-98FE-6C61703D4BE7", "versionEndExcluding": "6.2.4.2"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}