---
cve: "CVE-2024-21152"
severity: "HIGH"
cvss: 8.1
epss: "0.4%"
vendor: "Oracle Corporation"
kev: false
exploited: false
published: "2024-07-16 23:15:17"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-04T07:22:47+01:00"
---

# CVE-2024-21152

> 8.1 HIGH

## Beschreibung

Vulnerability in the Oracle Process Manufacturing Financials product of Oracle E-Business Suite (component: Allocation Rules).  Supported versions that are affected are 12.2.12-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Financials.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Financials accessible data as well as  unauthorized access to critical data or complete access to all Oracle Process Manufacturing Financials accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

## CNA-Record (Kanon, cvelistV5)

- CNA: **oracle**
- State: PUBLISHED
- Stand: 2024-08-01 22:13:42
- CNA-CVSS: **8.1** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-200** — Exposure of Sensitive Information to an Unauthorized Actor
  The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

## Angriffsmuster (CAPEC)

- [CAPEC-13 — Subverting Environment Variable Values](https://capec.mitre.org/data/definitions/13.html) _(Severity: Very High)_
- [CAPEC-22 — Exploiting Trust in Client](https://capec.mitre.org/data/definitions/22.html) _(Severity: High)_
- [CAPEC-116 — Excavation](https://capec.mitre.org/data/definitions/116.html) _(Severity: Medium)_
- [CAPEC-169 — Footprinting](https://capec.mitre.org/data/definitions/169.html) _(Severity: Very Low)_
- [CAPEC-224 — Fingerprinting](https://capec.mitre.org/data/definitions/224.html) _(Severity: Very Low)_
- [CAPEC-285 — ICMP Echo Request Ping](https://capec.mitre.org/data/definitions/285.html) _(Severity: Low)_
- [CAPEC-287 — TCP SYN Scan](https://capec.mitre.org/data/definitions/287.html) _(Severity: Low)_
- [CAPEC-290 — Enumerate Mail Exchange (MX) Records](https://capec.mitre.org/data/definitions/290.html) _(Severity: Low)_

## ATT&CK-Techniken

- [T1562.003 — Impair Defenses:Impair Command History Logging](https://attack.mitre.org/techniques/T1562/003/)
- [T1574.006 — Hijack Execution Flow:Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [T1574.007 — Hijack Execution Flow:Path Interception by PATH Environment ](https://attack.mitre.org/techniques/T1574/007/)
- [T1217 — Browser Bookmark Discovery](https://attack.mitre.org/techniques/T1217/)
- [T1592 — Gather Victim Host Information](https://attack.mitre.org/techniques/T1592/)
- [T1595 — Active Scanning](https://attack.mitre.org/techniques/T1595/)

## BSI-Hinweise (deutsch)

- [Oracle E-Business Suite: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2024-1640) — _BSI-Einstufung: hoch_
  Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle E-Business Suite ausnutzen, um die Vertraulichkeit und Integrität zu gefährden.

## Referenzen

- <https://www.oracle.com/security-alerts/cpujul2024.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2024-21152/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_