Information disclosure in Oracle Retail Xstore Office
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and 23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office. While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Xstore Office accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | Retail Xstore Office | 19.0.5; 20.0.3; 20.0.4; 22.0.0; 23.0.1 | — | No fix listed | CNA |
- Retail Xstore Office VendorOracle Affected 19.0.5; 20.0.3; 20.0.4; 22.0.0; 23.0.1 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:retail_xstore_office:19.0.5:*:*:*:*:*:*:* | 19.0.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_office:20.0.3:*:*:*:*:*:*:* | 20.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_office:20.0.4:*:*:*:*:*:*:* | 20.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_office:22.0.0:*:*:*:*:*:*:* | 22.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_office:23.0.1:*:*:*:*:*:*:* | 23.0.1 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:retail_xstore_office:19.0.5:*:*:*:*:*:*:* Versions 19.0.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_office:20.0.3:*:*:*:*:*:*:* Versions 20.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_office:20.0.4:*:*:*:*:*:*:* Versions 20.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_office:22.0.0:*:*:*:*:*:*:* Versions 22.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_office:23.0.1:*:*:*:*:*:*:* Versions 23.0.1 Vulnerable ·Oracle
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-21136
- 2026-10-03 Alias added: GHSA-2f5p-xhq6-2f67
References
Advisory 1
More Oracle Retail Xstore Office vulnerabilities
- TI-2019-02113 Vulnerability in the Oracle Retail Xstore Office component of Oracle Retail Applications… CVSS 3.0HIGH 8.2
- TI-2018-02410 Vulnerability in the Oracle Retail Xstore Office component of Oracle Retail Applications… CVSS 3.0HIGH 7.6
- TI-2018-02586 Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications… CVSS 3.1MEDIUM 5.4
- TI-2018-02192 Vulnerability in the Oracle Retail Xstore Office component of Oracle Retail Applications… CVSS 3.0MEDIUM 5.5
Sources
- CVE-2024-21136 · CVE Program
- CVE-2024-21136 · NVD
- FIRST EPSS
- GHSA-2f5p-xhq6-2f67 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences