PT-2023-1195 · Oracle · Oracle Communications Convergence

Published 2023-01-17 · Updated 2024-09-17 · CVE-2023-21848

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Communications Convergence versions 3.0.3.1.0

Description The issue is related to insufficient input validation in the Admin Configuration component of Oracle Communications Convergence, part of Oracle Communications Applications. This can be exploited by a remote attacker with low privileges and network access via HTTP, potentially leading to the takeover of Oracle Communications Convergence.

Recommendations For version 3.0.3.1.0, consider restricting access to the Admin Configuration component until a patch is available. As a temporary workaround, limit network access via HTTP to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Privilege Management

Weakness Enumeration

CWE-20

CWE-269

Related Identifiers

BDU:2023-00418

CVE-2023-21848

Affected Products

Oracle Communications Convergence

References · 5

• https://bdu.fstec.ru/vul/2023-00418 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-21848 · Security Note
• https://oracle.com/security-alerts/cpujan2023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21848 · Vendor Advisory
• https://t.me/cvenotify/42217 · Telegram Post