CVE-2024-20938

Summary

CVE-2024-20938 is a vulnerability affecting Oracle iStore, a component of Oracle E-Business Suite (versions 12.2.3-12.2.13). This easily exploitable issue allows unauthenticated attackers to compromise Oracle iStore via HTTP. While human interaction from a person other than the attacker is required for a successful attack, the impact could extend beyond Oracle iStore, potentially affecting additional products. Successful attacks may result in unauthorized update, insert, or delete access to some iStore data, as well as unauthorized read access to a subset of that data. The CVSS Base Score is 6.1, indicating low to medium severity for both confidentiality and integrity.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.