CVE-2023-21975: Critical severity oracle application express vulnerability
Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Customers Plugin: 18.2-22.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Application Express Customers Plugin. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express Customers Plugin, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Application Express Customers Plugin. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Oracle Application Express Customers Plugin vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-21975.
What is the severity level of CVE-2023-21975?
The severity level of CVE-2023-21975 is critical.
Which versions of the Application Express Customers Plugin are affected by CVE-2023-21975?
The affected versions of the Application Express Customers Plugin are 18.2-22.2.
How can a low privileged attacker exploit CVE-2023-21975?
A low privileged attacker with network access can easily exploit CVE-2023-21975.
Where can I find more information about CVE-2023-21975?
More information about CVE-2023-21975 can be found at https://www.oracle.com/security-alerts/cpujul2023.html.