CVE-2024-21136 Information disclosure in Retail Xstore Office
Unauthenticated attackers can access critical data in Oracle Retail Xstore Office via HTTP, leading to significant information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21136?
CVE-2024-21136 is a high-severity vulnerability in Oracle Corporation Retail Xstore Office, published on 16 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and 23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office. While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Xstore Office accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Weakness: CWE-200
Which versions are affected by CVE-2024-21136?
It affects 1 product.
Products include Oracle Retail Xstore Office.
How do I fix CVE-2024-21136?
No fix has been published for CVE-2024-21136 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-21136 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21136 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Oracle Corporation Retail Xstore Office
Sources
Also known as GHSA-2f5p-xhq6-2f67.