Oracle Enterprise Manager Base Platform 13.5.0.0 Host Management access control

Summaryinfo

A vulnerability categorized as critical has been discovered in Oracle Enterprise Manager Base Platform 13.5.0.0. This affects an unknown part of the component Host Management. Executing a manipulation can lead to Local Privilege Escalation. This vulnerability is registered as CVE-2024-21067. The attack needs to be launched locally. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Oracle Enterprise Manager Base Platform 13.5.0.0. This vulnerability affects an unknown functionality of the component Host Management. The manipulation with an unknown input leads to a local privilege escalation vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). The supported version that is affected is 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

The advisory is available at oracle.com. This vulnerability was named CVE-2024-21067 since 12/07/2023. The exploitation appears to be easy. Local access is required to approach this attack. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/15/2024). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Software Management Software

Vendor

• Oracle

Name

• Enterprise Manager Base Platform

Version

• 13.5.0.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion