Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Oracle Corporation Application Express (APEX)

CVE-2023-21974
CRITICAL 9.0

At a glance

Source
NVD
EPSS
EPSS 0.61 % · percentile 49 ()
State
PUBLISHED
Published
Updated
Assigner
oracle
NVD status
Modified

Search on…

Description

Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Team Calendar Plugin: 18.2-22.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Application Express Team Calendar Plugin. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express Team Calendar Plugin, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Application Express Team Calendar Plugin. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

References

Scores

VersionScoreVectorScored by
CVSS 3.1CRITICAL 9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Horacle
CVSS 3.1CRITICAL 9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HNVD · secalert_us@oracle.com (Secondary)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
Oracle Corporation · Application Express (APEX)affected Application Express Team Calendar Plugin: 18.2 ≤ 22.1

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD