Oracle Corporation Database - Enterprise Edition

CVE-2023-22077

MEDIUM 4.9

At a glance

Source: NVD
EPSS: EPSS 0.63 % · percentile 50 (2026-10-31)
State: PUBLISHED
Published: 2023-10-17 21:02 UTC
Updated: 2024-09-13 16:35 UTC
Assigner: oracle
NVD status: Modified

Search on…

Description

Vulnerability in the Oracle Database Recovery Manager component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows high privileged attacker having DBA account privilege with network access via Oracle Net to compromise Oracle Database Recovery Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Database Recovery Manager. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

References

https://www.oracle.com/security-alerts/cpuoct2023.html

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	oracle
CVSS 3.1	MEDIUM 4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	NVD · secalert_us@oracle.com (Secondary)

European references

ENISA EUVD · EUVD-2023-26242
GCVE · GCVE-0-2023-22077

CERT-FR advisories

CERTFR-2023-AVI-0860 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:oracle:database_server:*:*:*:*:enterprise:*:*:* ≥ 19.3 ≤ 19.20
cpe:2.3:a:oracle:database_server:*:*:*:*:enterprise:*:*:* ≥ 21.3 ≤ 21.11

Affected products

Product	Versions
Oracle Corporation · Database - Enterprise Edition	affected 19.3 ≤ 19.20 ; affected 21.3 ≤ 21.11

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Oracle Corporation Database - Enterprise Edition