CVE-2023-22077

🗓️ 17 Oct 2023 21:02:54Reported by oracleType

cve🔗 web.nvd.nist.gov👁 344 Views🌐 WEB

Vulnerability in Oracle Database Recovery Manager component. Easily exploitable

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2023-22077	18 Oct 202302:44	–	circl
CNNVD	Oracle Database Server Security Vulnerability	17 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-22077	17 Oct 202321:02	–	cvelist
EUVD	EUVD-2023-26242	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Oracle Database Server	19 Oct 202300:00	–	ncsc
NVD	CVE-2023-22077	17 Oct 202322:15	–	nvd
Oracle	Oracle Critical Patch Update Advisory - October 2023	17 Oct 202300:00	–	oracle
Tenable Nessus	Oracle Database Server (October 2023 CPU)	20 Oct 202300:00	–	nessus
Packet Storm	📄 Oracle 19c / 21c Denial of Service	5 Aug 202500:00	–	packetstorm
Prion	Design/Logic Flaw	17 Oct 202322:15	–	prion

NVD

Vulners

Node

oracle database_serverRange19.3–19.20enterprise

oracle database_serverRange21.3–21.11enterprise

[
  {
    "vendor": "Oracle Corporation",
    "product": "Database - Enterprise Edition",
    "versions": [
      {
        "version": "19.3",
        "status": "affected",
        "lessThanOrEqual": "19.20",
        "versionType": "custom"
      },
      {
        "version": "21.3",
        "status": "affected",
        "lessThanOrEqual": "21.11",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/security-alerts/cpuoct2023.html

Parameter	Position	Path	Description	CWE
RAMBO	path	/opt/oracle/product/19c/dbhome_1/dbs/	Directory path used in PoC to weaponize UTL_FILE for DOS within a PDB, illustrating a potential attack vector from PDB to CDB.
spfileORCLCDB.ora	path	/opt/oracle/product/19c/dbhome_1/dbs/spfileORCLCDB.ora	Planned manipulation of the server parameter file as part of the PoC to disrupt startup after lockdown profile misuse.

21 Nov 2024 07:44Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.14.9

EPSS0.00033

SSVC