PT-2023-6300 · Oracle · Oracle Database Server

Published 2023-10-17 · Updated 2023-10-23 · CVE-2023-22073

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.20 Oracle Database Server versions 21.3 through 21.11

Description The issue is related to insufficient input validation in the Oracle Notification Server component of Oracle Database Server. This easily exploitable vulnerability allows an unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Notification Server executes to compromise Oracle Notification Server. Successful attacks can result in unauthorized read access to a subset of Oracle Notification Server accessible data.

Recommendations For versions 19.3 through 19.20, update to a version outside of this range to mitigate the risk. For versions 21.3 through 21.11, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Oracle Notification Server component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-07011

CVE-2023-22073

Affected Products

Oracle Database Server

References · 8

• https://oracle.com/security-alerts/cpuoct2023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22073 · Security Note
• https://bdu.fstec.ru/vul/2023-07011 · Security Note
• https://t.me/cvenotify/59616 · Telegram Post
• https://twitter.com/CVEnew/status/1714390751709159537 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1714451390523666479 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023101771 · Note