Critical Vulnerability Discovered in Oracle E-Business Suite

What changed

A significant vulnerability has been uncovered in the Oracle E-Business Suite, specifically within the Concurrent Processing component. This issue could allow unauthenticated attackers to exploit the system via HTTP, leading to potential takeover of the affected processes.

The vulnerability has been assigned a CVSS 3.1 Base Score of 9.8, indicating critical risks to confidentiality, integrity, and availability.

Who is affected

The vulnerability impacts several versions of Oracle E-Business Suite, particularly those ranging from 12.2.3 to 12.2.14. Organizations utilizing these versions should be particularly vigilant.

The following groups and products are notably affected:

• Oracle E-Business Suite users on versions 12.2.3 to 12.2.14
• Businesses relying on Oracle Concurrent Processing for their operations
• Organizations that utilize BI Publisher Integration within their systems
• IT departments tasked with maintaining Oracle software environments

What to do

Organizations should prioritize immediate assessment of their Oracle E-Business Suite installations to determine if they are running affected versions. Prompt action is necessary to mitigate risks associated with this vulnerability.

It is recommended to apply any available patches or updates provided by Oracle as soon as possible.

• Review current Oracle E-Business Suite versions and configurations
• Implement security patches released by Oracle without delay
• Conduct a thorough security audit to identify potential vulnerabilities
• Enhance network security measures to prevent unauthorized access