Log in Start free

Vulnerability · Published Apr 18, 2023 · Assigned by oracle

CVE-2023-21932

High 7.2

In plain English

A high-severity security flaw in Hospitality OPERA 5 Property Services from Oracle Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 45.0% (higher than 99% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)45.0%top 1.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI). The supported version that is affected is 5.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. While the vulnerability is in Oracle Hospitality OPERA 5 Property Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality OPERA 5 Property Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L).

Affected products (as reported)

VendorProductVersions
Oracle Corporation Hospitality OPERA 5 Property Services 5.6

References