CVE-2024-21028

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
6.1MEDIUM
EPSS
0.8%
top 25.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Oracle Complex Maintenance Repair AND Overhaul
Timeline
PublishedApr 16
Latest updateApr 17

Description

Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair, and Overhaul. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Complex Maintenance, Repair, and Overh…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-5r3q-45rq-jqw2: Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV)↗2024-04-17
▶
CVEList
CVE-2024-21028: Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV)↗2024-04-16
▶

📋Vendor Advisories

1
Oracle
Oracle Oracle E-Business Suite Risk Matrix: LOV — CVE-2024-21028↗2024-04-15
▶
CVE-2024-21028 (MEDIUM CVSS 6.1) | Vulnerability in the Oracle Complex | cvebase.io