Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Oracle Corporation Application Express (APEX)

CVE-2023-21974
CRITICAL 9.0

En bref

Source
NVD
EPSS
EPSS 0.61 % · centile 49 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
oracle
Statut NVD
Modified

Rechercher sur…

Description

Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Team Calendar Plugin: 18.2-22.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Application Express Team Calendar Plugin. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express Team Calendar Plugin, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Application Express Team Calendar Plugin. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1CRITICAL 9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Horacle
CVSS 3.1CRITICAL 9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HNVD · secalert_us@oracle.com (Secondary)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Oracle Corporation · Application Express (APEX)affected Application Express Team Calendar Plugin: 18.2 ≤ 22.1

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD