// For flags

CVE-2024-20916

 

Severity Score

8.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). The supported version that is affected is 13.5.0.0. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Base Platform accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L).

Vulnerabilidad en el producto Oracle Enterprise Manager Base Platform de Oracle Enterprise Manager (componente: Gestión de eventos). La versión compatible afectada es 13.5.0.0. Una vulnerabilidad fácilmente explotable permite a un atacante con altos privilegios acceder al segmento de comunicación física conectado al hardware donde se ejecuta la plataforma base de Oracle Enterprise Manager para comprometer la plataforma base de Oracle Enterprise Manager. Si bien la vulnerabilidad está en la plataforma base de Oracle Enterprise Manager, los ataques pueden afectar significativamente a productos adicionales (scope change). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a la creación, eliminación o modificación de datos críticos o a todos los datos accesibles de la plataforma base de Oracle Enterprise Manager, así como acceso no autorizado a datos críticos o acceso completo a todos los datos accesibles y capacidades no autorizadas de la plataforma base de Oracle Enterprise Manager. provocar una denegación parcial de servicio (DOS parcial) de la plataforma base Oracle Enterprise Manager. CVSS 3.1 Puntuación base 8.3 (impactos en la confidencialidad, la integridad y la disponibilidad). Vector CVSS: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L).

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-07 CVE Reserved
  • 2024-01-16 CVE Published
  • 2024-08-01 CVE Updated
  • 2024-10-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
Enterprise Manager
Search vendor "Oracle" for product "Enterprise Manager"
13.5.0.0
Search vendor "Oracle" for product "Enterprise Manager" and version "13.5.0.0"
-
Affected