CVE-2023-22071

{"id": "CVE-2023-22071", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.7}]}, "published": "2023-10-17T22:15:12.837", "references": [{"url": "https://www.oracle.com/security-alerts/cpuoct2023.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the PL/SQL component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute on sys.utl_http privilege with network access via Oracle Net to compromise PL/SQL. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PL/SQL, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PL/SQL accessible data as well as unauthorized read access to a subset of PL/SQL accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PL/SQL. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)."}, {"lang": "es", "value": "Vulnerabilidad en el componente PL/SQL de Oracle Database Server. Las versiones compatibles que se ven afectadas son 19.3-19.20 y 21.3-21.11. Una vulnerabilidad f\u00e1cilmente explotable permite que un atacante con privilegios elevados que tenga privilegios de Create Session y ejecutar en sys.utl_http con acceso a la red a trav\u00e9s de Oracle Net comprometa PL/SQL. Los ataques exitosos requieren la interacci\u00f3n humana de una persona distinta del atacante y, si bien la vulnerabilidad est\u00e1 en PL/SQL, los ataques pueden afectar significativamente a productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden dar como resultado una actualizaci\u00f3n, inserci\u00f3n o eliminaci\u00f3n no autorizada de algunos datos accesibles de PL/SQL, as\u00ed como un acceso de lectura no autorizado a un subconjunto de datos accesibles de PL/SQL y la capacidad no autorizada de causar una denegaci\u00f3n parcial de servicio (parcial). DOS) de PL/SQL. CVSS 3.1 Puntuaci\u00f3n base 5,9 (impactos en la confidencialidad, la integridad y la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)."}], "lastModified": "2023-10-23T18:20:32.617", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "32E02E1D-EF08-47A1-9095-06F9F2D8D268", "versionEndIncluding": "19.20", "versionStartIncluding": "19.3"}, {"criteria": "cpe:2.3:a:oracle:database_server:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "84088F94-42E8-4553-AE33-A5C4E954C83F", "versionEndIncluding": "21.11", "versionStartIncluding": "21.3"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}