CVE-2023-22022

Vulnerability in the Oracle Health Sciences Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Blinding Functionality). Supported versions that are affected are 3.1.0.2, 3.1.1.3 and 3.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Health Sciences Sciences Data Management Workbench. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Health Sciences Sciences Data Management Workbench accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2023.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:health_sciences_applications:3.1.0.2:::::::*
	cpe:2.3:a:oracle:health_sciences_applications:3.1.1.3:::::::*
	cpe:2.3:a:oracle:health_sciences_applications:3.2.0.0:::::::*

History

No history.

Information

Published : 2023-07-18 21:15

Updated : 2023-07-27 17:36

NVD link : CVE-2023-22022

Mitre link : CVE-2023-22022

CVE.ORG link : CVE-2023-22022

JSON object : View

Products Affected

oracle

health_sciences_applications

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-22022", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-07-18T21:15:13.077", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2023.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Health Sciences Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Blinding Functionality). Supported versions that are affected are 3.1.0.2, 3.1.1.3 and 3.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Health Sciences Sciences Data Management Workbench. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Health Sciences Sciences Data Management Workbench accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."}], "lastModified": "2023-07-27T17:36:46.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:health_sciences_applications:3.1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6566D0B9-4BBA-4DCA-BB4F-5E674C45BB6D"}, {"criteria": "cpe:2.3:a:oracle:health_sciences_applications:3.1.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50BF1DE3-F516-49AF-81B8-12950E09F183"}, {"criteria": "cpe:2.3:a:oracle:health_sciences_applications:3.2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA09732D-6104-4131-B799-685D71F915D9"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}