Login Request a demo
High severity · published Oct 15, 2024
CVE-2024-21246
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality)
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Service Bus accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Oracle Service Bus · Oracle Corporation
12.2.1.4.0 · source: vendor
SB
Service Bus · Oracle
12.2.1.4.0 · source: NVD
Affected product
OS
Oracle Service Bus
Oracle Corporation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21246
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21246
Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2024.html
More from Oracle Service Bus
7.6
CVE-2017-10119
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: OSB Web Console Design, Admin)
7.3
CVE-2019-10086
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property…
7.3
CVE-2017-3507
Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Console Design)
6.5
CVE-2024-21205
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality)
6.1
CVE-2015-9251
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript…