Vulnerability · Published Jan 17, 2023 · Assigned by oracle

CVE-2023-21893

High 7.5

In plain English

A high-severity improper access control in Data Provider for .NET from Oracle Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	oracle.manageddataaccess	21.9.0	GHSA-5pm2-9mr2-3frq
NuGet	oracle.manageddataaccess	19.18.0	GHSA-5pm2-9mr2-3frq
NuGet	oracle.manageddataaccess.core	3.21.90	GHSA-5pm2-9mr2-3frq
NuGet	oracle.manageddataaccess.core	2.19.180	GHSA-5pm2-9mr2-3frq

Affected products (as reported)

Vendor	Product	Versions
Oracle Corporation	Data Provider for .NET	19c21c

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Oracle Advisory vendor-advisory