CVE-2024-21048

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: XML input). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Web Applications Desktop Integrator accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpuapr2024.html	Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2024.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:web_applications_desktop_integrator:*:*:*:*:*:*:*:*

History

19 Mar 2025, 18:15

Type	Values Removed	Values Added
CWE		CWE-611

06 Dec 2024, 19:46

Type	Values Removed	Values Added
First Time		Oracle Oracle web Applications Desktop Integrator
CWE		NVD-CWE-noinfo
References	~~() https://www.oracle.com/security-alerts/cpuapr2024.html -~~	() https://www.oracle.com/security-alerts/cpuapr2024.html - Vendor Advisory
CPE		cpe:2.3:a:oracle:web_applications_desktop_integrator::::::::

21 Nov 2024, 08:53

Type	Values Removed	Values Added
References	~~() https://www.oracle.com/security-alerts/cpuapr2024.html -~~	() https://www.oracle.com/security-alerts/cpuapr2024.html -

17 Apr 2024, 12:48

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-04-16 22:15

Updated : 2025-04-10 18:14

NVD link : CVE-2024-21048

Mitre link : CVE-2024-21048

CVE.ORG link : CVE-2024-21048

JSON object : View

Products Affected

oracle

web_applications_desktop_integrator

CWE

NVD-CWE-noinfo CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2024-21048", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-04-16T22:15:21.810", "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2024.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2024.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: XML input). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Web Applications Desktop Integrator accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Web Applications Desktop Integrator de Oracle E-Business Suite (componente: entrada XML). Las versiones compatibles que se ven afectadas son 12.2.3-12.2.13. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante con pocos privilegios y acceso a la red a trav\u00e9s de HTTP comprometer Oracle Web Applications Desktop Integrator. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle Web Applications Desktop Integrator. CVSS 3.1 Puntaje base 4.3 (Impactos en la confidencialidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)."}], "lastModified": "2025-04-10T18:14:41.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:web_applications_desktop_integrator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F91CBAAD-6163-487C-9C7C-D89423E6A6F6", "versionEndIncluding": "12.2.13", "versionStartIncluding": "12.2.3"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}