Oracle Corporation Database - Enterprise Edition

CVE-2023-22077

MEDIUM 4.9

En bref

Source: NVD
EPSS: EPSS 0.63 % · centile 50 (2026-10-31)
État: PUBLISHED
Publiée: 2023-10-17 21:02 UTC
Mise à jour: 2024-09-13 16:35 UTC
Attribuée par: oracle
Statut NVD: Modified

Rechercher sur…

Description

Vulnerability in the Oracle Database Recovery Manager component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows high privileged attacker having DBA account privilege with network access via Oracle Net to compromise Oracle Database Recovery Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Database Recovery Manager. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Références

https://www.oracle.com/security-alerts/cpuoct2023.html

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	oracle
CVSS 3.1	MEDIUM 4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	NVD · secalert_us@oracle.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2023-26242
GCVE · GCVE-0-2023-22077

Avis du CERT-FR

CERTFR-2023-AVI-0860 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:oracle:database_server:*:*:*:*:enterprise:*:*:* ≥ 19.3 ≤ 19.20
cpe:2.3:a:oracle:database_server:*:*:*:*:enterprise:*:*:* ≥ 21.3 ≤ 21.11

Produits affectés

Produit	Versions
Oracle Corporation · Database - Enterprise Edition	affected 19.3 ≤ 19.20 ; affected 21.3 ≤ 21.11

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Oracle Corporation Database - Enterprise Edition