CVE-2023-22071
First published: Tue Oct 17 2023(Updated: )
Vulnerability in the PL/SQL component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute on sys.utl_http privilege with network access via Oracle Net to compromise PL/SQL. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PL/SQL, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PL/SQL accessible data as well as unauthorized read access to a subset of PL/SQL accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PL/SQL. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L).
Credit: secalert_us@oracle.com secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Database Server | >=19.3<=19.20 | |
| Oracle Database Server | >=21.3<=21.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-22071.
What is the title of the vulnerability?
The title of the vulnerability is 'Vulnerability in the PL/SQL component of Oracle Database Server.'
Which versions of Oracle Database Server are affected?
The affected versions of Oracle Database Server are 19.3-19.20 and 21.3-21.11.
What privileges does the attacker need to exploit the vulnerability?
The attacker needs the 'Create Session' and 'Execute' privileges on the 'sys.utl_http' component with network access via Oracle Net.
What is the severity of the vulnerability?
The severity of the vulnerability is medium (5.9).
Where can I find more information about the vulnerability?
You can find more information about the vulnerability on the Oracle website: https://www.oracle.com/security-alerts/cpuoct2023.html
- collector/nvd-index
- collector/nvd-api
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/references
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/oracle
- canonical/oracle database server
- version/oracle database server/19.3
- version/oracle database server/19.20
- version/oracle database server/21.3
- version/oracle database server/21.11