CVE-2024-21036 — Cross-site Scripting in Oracle Complex Maintenance Repair AND Overhaul

CWE-79 — Cross-site Scripting5 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.6%
top 29.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Oracle Complex Maintenance Repair AND Overhaul
Timeline
PublishedApr 16
Latest updateJul 15

Description

Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair, and Overhaul. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Complex Maintenance, Repair, and Overh…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-qfqh-2r56-v98p: Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV)↗2024-04-17
▶
CVEList
CVE-2024-21036: Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV)↗2024-04-16
▶

📋Vendor Advisories

2
Oracle
Oracle Oracle Insurance Applications Risk Matrix: Architecture (aCropalypse) — CVE-2023-21036↗2024-07-15
▶
Oracle
Oracle Oracle E-Business Suite Risk Matrix: LOV — CVE-2024-21036↗2024-04-15
▶
CVE-2024-21036 — Cross-site Scripting in Oracle | cvebase