ByteOS

FLEXCUBE Universal Banking

Product

Versions

Affected

12.3
12.4
From 14.0 through 14.3 (custom)
From 14.5 through 14.7 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data.

Type: N/A

CWE ID: N/A

Description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data.

Metrics

Version	Base score	Base severity	Vector
3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuoct2023.html	vendor-advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2023.html

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpuoct2023.html	vendor-advisory x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2023.html

Resource:

vendor-advisory

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:17 Oct, 2023 | 22:15

Updated At:23 Oct, 2023 | 18:21

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CPE Matches

cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:*

>>flexcube_universal_banking>>Versions from 14.0.0(inclusive) to 14.3.0(inclusive)

cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:*

>>flexcube_universal_banking>>Versions from 14.5.0(inclusive) to 14.7.0(inclusive)

cpe:2.3:a:oracle:flexcube_universal_banking:12.3.0:*:*:*:*:*:*:*

>>flexcube_universal_banking>>12.3.0

cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:*

>>flexcube_universal_banking>>12.4.0

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://www.oracle.com/security-alerts/cpuoct2023.html	secalert_us@oracle.com	Patch Vendor Advisory

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2023.html

Source: secalert_us@oracle.com

Resource:

Patch

Vendor Advisory

Similar CVEs

106Records found

CVE-2021-2373

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.17% / 38.28%

7 Day CHG~0.00%

Published-20 Jul, 2021 | 22:43

Updated-26 Sep, 2024 | 13:58

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime). Supported versions that are affected are 9.2.5.3 and Prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Product-jd_edwards_enterpriseone_tools JD Edwards EnterpriseOne Tools

CVE-2021-2345

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.26% / 48.67%

7 Day CHG~0.00%

Published-20 Jul, 2021 | 22:43

Updated-26 Sep, 2024 | 14:04

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is 11.3.1.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Product-commerce_experience_manager commerce_guided_search Commerce Guided Search / Oracle Commerce Experience Manager

CVE-2021-20562

Matching Score-8

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.71% / 71.45%

7 Day CHG~0.00%

Published-27 Jul, 2021 | 11:25

Updated-16 Sep, 2024 | 16:48

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199232.

Product-sterling_b2b_integrator solaris linux_kernel i hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-2117

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 40.49%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:50

Updated-26 Sep, 2024 | 18:14

Vulnerability in the Oracle Application Express Survey Builder component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Survey Builder. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Survey Builder, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Survey Builder accessible data as well as unauthorized read access to a subset of Oracle Application Express Survey Builder accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Product-application_express_survey_builder Application Express (APEX)

CVE-2021-20560

Matching Score-8

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.08% / 23.44%

7 Day CHG~0.00%

Published-26 Jul, 2021 | 12:10

Updated-16 Sep, 2024 | 16:33

IBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and 1.5.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 199229.

Product-solaris sterling_connect_direct_user_interface linux_kernel hp-ux windows aix Sterling Connect:Direct Browser User Interface

CWE ID-CWE-1021

Improper Restriction of Rendered UI Layers or Frames

CVE-2021-2003

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 40.49%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:50

Updated-26 Sep, 2024 | 18:44

Vulnerability in the Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Dashboards). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).