PT-2023-9567 · Oracle · Oracle Database Server

Emad Al-Mousa · Publicado 2023-12-07 · Atualizado 2024-10-31 · CVE-2024-21233

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.24 Oracle Database Server versions 21.3 through 21.15 Oracle Database Server versions 23.4 through 23.5

Description The issue is related to improper authorization in the Database Core Component of Oracle Database Server. This can allow a remote attacker to gain unauthorized access to read, modify, or delete data. Successful attacks can result in unauthorized update, insert, or delete access to some of the Oracle Database Core accessible data.

Recommendations For versions 19.3 through 19.24, update to a version outside of this range to mitigate the risk. For versions 21.3 through 21.15, update to a version outside of this range to mitigate the risk. For versions 23.4 through 23.5, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting network access via Oracle Net to minimize the risk of exploitation.

Correção

Improper Authorization

Side Channel Attack

Enumeração de Fraquezas

CWE-285

CWE-203

Identificadores relacionados

BDU:2024-08446

CVE-2024-21233

Produtos afetados

Oracle Database Server

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-21233 · Nota de Segurança
• https://oracle.com/security-alerts/cpuoct2024.html · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1846284353455718726 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-21233 · Aviso do Fabricante
• https://vuldb.com/?id.280480 · Nota
• https://t.me/cvenotify/98985 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-08446 · Nota de Segurança