PT-2023-2497 · Oracle · Oracle Hospitality Opera 5 Property Services

Brendan Scarvell + 3 · Published 2023-04-18 · Updated 2023-05-02 · CVE-2023-21932

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Oracle Hospitality OPERA 5 Property Services version 5.6

Description The issue is related to insufficient input validation in the OXI component of Oracle Hospitality OPERA 5 Property Services. This allows a remote attacker with high privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized updates, inserts, or deletes to some accessible data, and a partial denial of service. The vulnerability can significantly impact additional products.

Recommendations For Oracle Hospitality OPERA 5 Property Services version 5.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the OXI component to minimize the risk of exploitation. Avoid using HTTP requests to the vulnerable component until the issue is resolved.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-02289

CVE-2023-21932

Affected Products

Oracle Hospitality Opera 5 Property Services

References · 5

• https://oracle.com/security-alerts/cpuapr2023.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21932 · Security Note
• https://osv.dev/vulnerability/CVE-2023-21932 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02289 · Security Note
• https://t.me/thebugbountyhunter/7292 · Telegram Post