PT-2023-9567 · Oracle · Oracle Database Server

Emad Al-Mousa · Published 2023-12-07 · Updated 2024-10-31 · CVE-2024-21233

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.24 Oracle Database Server versions 21.3 through 21.15 Oracle Database Server versions 23.4 through 23.5

Description The issue is related to improper authorization in the Database Core Component of Oracle Database Server. This can allow a remote attacker to gain unauthorized access to read, modify, or delete data. Successful attacks can result in unauthorized update, insert, or delete access to some of the Oracle Database Core accessible data.

Recommendations For versions 19.3 through 19.24, update to a version outside of this range to mitigate the risk. For versions 21.3 through 21.15, update to a version outside of this range to mitigate the risk. For versions 23.4 through 23.5, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting network access via Oracle Net to minimize the risk of exploitation.

Fix

Improper Authorization

Side Channel Attack

Weakness Enumeration

CWE-285

CWE-203

Related Identifiers

BDU:2024-08446

CVE-2024-21233

Affected Products

Oracle Database Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-21233 · Security Note
• https://oracle.com/security-alerts/cpuoct2024.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21233 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08446 · Security Note
• https://twitter.com/CVEnew/status/1846284353455718726 · Twitter Post
• https://vuldb.com/?id.280480 · Note
• https://t.me/cvenotify/98985 · Telegram Post