PT-2023-4015 · Oracle · Android Mobile Authenticator App+1

Sheikh Rishad · Published 2023-07-18 · Updated 2023-07-27 · CVE-2023-21994

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Mobile Security Suite versions prior to 11.1.2.3.1

Description The issue is related to errors in processing input data in the Android Mobile Authenticator App component of the Oracle Mobile Security Suite product. This can allow an attacker to gain unauthorized access to protected information. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data.

Recommendations For versions prior to 11.1.2.3.1, update to version 11.1.2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the physical communication segment attached to the hardware where the Oracle Mobile Security Suite executes to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-04313

CVE-2023-21994

Affected Products

Android Mobile Authenticator App

Oracle Mobile Security Suite

References · 7

• https://osv.dev/vulnerability/CVE-2023-21994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21994 · Security Note
• https://oracle.com/security-alerts/cpujul2023.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04313 · Security Note
• https://cybersecurity-help.cz/vdb/SB2023071980 · Note
• https://vuldb.com/?id.234825 · Note
• https://t.me/cvenotify/54574 · Telegram Post