CVE-2023-22106

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: API). Supported versions that are affected are ECC: 8, 9 and 10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpuoct2023.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:enterprise_command_center_framework:8.0:::::::*
	cpe:2.3:a:oracle:enterprise_command_center_framework:9.0:::::::*
	cpe:2.3:a:oracle:enterprise_command_center_framework:10.0:::::::*

History

No history.

Information

Published : 2023-10-17 22:15

Updated : 2023-10-23 18:21

NVD link : CVE-2023-22106

Mitre link : CVE-2023-22106

CVE.ORG link : CVE-2023-22106

JSON object : View

Products Affected

oracle

enterprise_command_center_framework

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-22106", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-10-17T22:15:15.377", "references": [{"url": "https://www.oracle.com/security-alerts/cpuoct2023.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: API). Supported versions that are affected are ECC: 8, 9 and 10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Enterprise Command Center Framework de Oracle E-Business Suite (componente: API). Las versiones compatibles que se ven afectadas son ECC: 8, 9 y 10. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante con pocos privilegios y acceso a la red a trav\u00e9s de HTTP comprometer Oracle Enterprise Command Center Framework. Los ataques exitosos a esta vulnerabilidad pueden resultar en un acceso no autorizado a datos cr\u00edticos o un acceso completo a todos los datos accesibles de Oracle Enterprise Command Center Framework. CVSS 3.1 Puntaje base 6.5 (Impactos en la confidencialidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."}], "lastModified": "2023-10-23T18:21:13.897", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:enterprise_command_center_framework:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BFFA86D-F43E-4329-A58A-75052BE3A03F"}, {"criteria": "cpe:2.3:a:oracle:enterprise_command_center_framework:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D2F1A03-9F1A-4F3A-885F-9F1640CEF9ED"}, {"criteria": "cpe:2.3:a:oracle:enterprise_command_center_framework:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93D67729-C882-4D4D-9D43-C9EA9DE59CA8"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}