Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-20905: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are Prior to 9.2.8.0. Easily explo...

CVE-2024-20905 · published 2 years ago

Summary

What to do

Update oracle jd_edwards_enterpriseone_tools to version 9.2.8.0 or later.

Affected software

Vendor	Product	Affected versions
oracle	jd_edwards_enterpriseone_tools	< 9.2.8.0 `cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::`

Original advisory text

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are Prior to 9.2.8.0. Easily explo...

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are Prior to 9.2.8.0. Easily exploitable vulnerability allows high privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

References

https://www.oracle.com/security-alerts/cpujan2024.html Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.7 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-404Improper Resource Shutdown or Release

Timeline

Published17 Feb 2024

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2024-20905 · NVD

Track software like this

Free during beta