Skip to main content

Installed Base CVE-2024-20935

MEDIUM
2024-02-17 secalert_us@oracle.com
Authentication Bypass Oracle Installed Base
6.1
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Feb 17, 2024 - 02:15 cve.org
MEDIUM 6.1

DescriptionCVE.org

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Installed Base accessible data as well as unauthorized read access to a subset of Oracle Installed Base accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Installed Base accessible data as well as unauthorized read access to a subset of Oracle Installed Base accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Affected products include: Oracle Installed Base.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Installed Base

View all
CVE-2026-60738 HIGH
8.8 Jul 21

Takeover of the Oracle Installed Base component in Oracle E-Business Suite (Create Item Instance function) is possible b
CVE-2026-62473 HIGH
8.3 Jul 21

Data compromise in Oracle Installed Base (Oracle E-Business Suite, Create Item Instance component) versions 12.2.3 throu
CVE-2017-3361 HIGH
8.2 Jan 27

Vulnerability in the Oracle Installed Base component of Oracle E-Business Suite (subcomponent: User Interface). Rated hi
CVE-2026-60904 HIGH
8.1 Jul 21

Data compromise in Oracle E-Business Suite's Installed Base module (Create Item Instance component) lets a low-privilege
CVE-2026-62472 HIGH
8.1 Jul 21

Data compromise in Oracle Installed Base (Create Item Instance component) of Oracle E-Business Suite versions 12.2.4 thr
CVE-2021-2231 HIGH
8.1 Apr 22

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: APIs). Rated high severity (CV
CVE-2026-60908 HIGH
7.1 Jul 21

Unauthorized data access in Oracle Installed Base (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15)
CVE-2026-70775 MEDIUM
6.3 Aug 18

Oracle Installed Base within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes its User Interface compon
CVE-2024-21072 MEDIUM
6.1 Apr 16

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Data Provider UI). Rated mediu
CVE-2024-20941 MEDIUM
6.1 Feb 17

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: HTML UI). Rated medium severit
CVE-2024-20933 MEDIUM
6.1 Feb 17

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Rat
CVE-2024-20934 MEDIUM
6.1 Jan 16

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Rat

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2024-20935 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy