PT-2023-2497 · Oracle · Oracle Hospitality Opera 5 Property Services

Brendan Scarvell + 3 · Publicado 2023-04-18 · Atualizado 2023-05-02 · CVE-2023-21932

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Oracle Hospitality OPERA 5 Property Services version 5.6

Description The issue is related to insufficient input validation in the OXI component of Oracle Hospitality OPERA 5 Property Services. This allows a remote attacker with high privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized updates, inserts, or deletes to some accessible data, and a partial denial of service. The vulnerability can significantly impact additional products.

Recommendations For Oracle Hospitality OPERA 5 Property Services version 5.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the OXI component to minimize the risk of exploitation. Avoid using HTTP requests to the vulnerable component until the issue is resolved.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-02289

CVE-2023-21932

Produtos afetados

Oracle Hospitality Opera 5 Property Services

Referências · 5

• https://oracle.com/security-alerts/cpuapr2023.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-21932 · Nota de Segurança
• https://t.me/thebugbountyhunter/7292 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-21932 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02289 · Nota de Segurança