CVE-2024-21073

HIGH

Oracle Trade Management 12.2.3-12.2.13 - Unauthenticated Exposure of Sensitive Information in Claim LOV

Title source: llm
STIX 2.1

Description

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0051
EPSS Percentile 66.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (1)
oracle/trade_management 12.2.3 - 12.2.13
Published Apr 16, 2024
Tracked Since Feb 18, 2026