Skip to main content

Common Applications CVE-2024-20947

MEDIUM
2024-02-17 secalert_us@oracle.com
Authentication Bypass Oracle Common Applications
5.4
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Feb 17, 2024 - 02:15 cve.org
MEDIUM 5.4

DescriptionCVE.org

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Common Applications accessible data as well as unauthorized read access to a subset of Oracle Common Applications accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Common Applications accessible data as well as unauthorized read access to a subset of Oracle Common Applications accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Affected products include: Oracle Common Applications.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Common Applications

View all
CVE-2017-10330 CRITICAL
9.1 Oct 19

Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: Gantt Server). Rated
CVE-2017-10113 HIGH
8.2 Aug 08

Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: CRM User Management

CVE-2017-3327 HIGH
8.2 Jan 27

Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: Resources Module). R
CVE-2017-3326 HIGH
8.2 Jan 27

Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: Role Summary). Rated
CVE-2017-3443 HIGH
8.2 Jan 27

Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: User Interface). Rat
CVE-2017-3328 HIGH
8.2 Jan 27

Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: Resources Module). R
CVE-2021-2436 HIGH
8.2 Jul 21

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Frame
CVE-2021-2093 HIGH
8.2 Jan 20

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Frame
CVE-2020-14688 HIGH
8.2 Jul 15

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Frame
CVE-2019-2665 HIGH
8.2 Apr 23

Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: CRM User Management

CVE-2025-30716 HIGH
7.5 Apr 15

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Frame
CVE-2016-5575 MEDIUM
5.3 Oct 25

Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1 through

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-20947 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy