CVE-2024-21100

4 documents4 sources
Severity
4.0MEDIUM
EPSS
0.3%
top 50.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Oracle Corporation Commerce PlatformOracle Commerce Platform
Timeline
PublishedApr 16
Latest updateApr 17

Description

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Platform). Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. While the vulnerability is in Oracle Commerce Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update,…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages2 packages

▶NVDoracle/commerce_platform11.3.0, 11.3.1, 11.3.2+2
▶CVEListV5oracle_corporation/commerce_platform11.3.0, 11.3.1, 11.3.2+2

🔴Vulnerability Details

2
GHSA
GHSA-mw72-pm78-7w47: Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Platform)↗2024-04-17
▶
CVEList
CVE-2024-21100: Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Platform)↗2024-04-16
▶

📋Vendor Advisories

1
Oracle
Oracle Oracle Commerce Risk Matrix: Platform — CVE-2024-21100↗2024-04-15
▶