PT-2023-6197 · Oracle · Oracle Database Server

Emad Al-Mousa · Published 2023-10-17 · Updated 2024-02-01 · CVE-2023-22074

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.20 Oracle Database Server versions 21.3 through 21.11

Description The issue is related to insufficient input validation in the Database Sharding component of Oracle Database Server. This can be exploited by a remote attacker to cause a partial denial of service. The attack requires human interaction from a person other than the attacker and can be carried out by a high-privileged attacker with Create Session and Select Any Dictionary privileges via Oracle Net. Successful exploitation can result in unauthorized ability to cause a partial denial of service of Oracle Database Sharding.

Recommendations For Oracle Database Server versions 19.3 through 19.20, update to a version outside of this range to mitigate the risk. For Oracle Database Server versions 21.3 through 21.11, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Database Sharding component until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-06906

CVE-2023-22074

Affected Products

Oracle Database Server

References · 7

• 🔥 http://packetstormsecurity.com/files/175352/Oracle-19c-21c-Sharding-Component-Password-Hash-Exposure.html · Exploit
• https://oracle.com/security-alerts/cpuoct2023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22074 · Security Note
• https://bdu.fstec.ru/vul/2023-06906 · Security Note
• https://twitter.com/VulmonFeeds/status/1714444002643087853 · Twitter Post
• https://twitter.com/CVEnew/status/1714390750572511630 · Twitter Post