PT-2023-3697 · Oracle · Application Express Administration

Dirk Van Veen · Published 2023-07-18 · Updated 2023-07-27 · CVE-2023-21983

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Application Express Administration versions 18.2 through 22.2

Description The issue is related to insufficient input validation in the Application Express Administration product of Oracle Application Express. It allows an unauthenticated attacker with network access via HTTP to compromise the Application Express Administration. Successful attacks can result in unauthorized update, insert, or delete access to some data, as well as unauthorized read access to a subset of data and the ability to cause a partial denial of service.

Recommendations For versions 18.2 through 22.2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Application Express Administration product to minimize the risk of exploitation. Avoid using the HTTP protocol to access the Application Express Administration until the issue is resolved. Restrict network access to the Application Express Administration product to prevent unauthorized attacks.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-03985

CVE-2023-21983

Affected Products

Application Express Administration

References · 5

• https://bdu.fstec.ru/vul/2023-03985 · Security Note
• https://oracle.com/security-alerts/cpujul2023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21983 · Security Note
• https://t.me/cvenotify/54594 · Telegram Post