CVE-2023-22077

🗓️ 17 Oct 2023 21:02:54Reported by oracleType

cve🔗 web.nvd.nist.gov👁 354 Views🌐 WEB

Vulnerability in Oracle Database Recovery Manager component. Easily exploitable

Reporter	Title	Published	Views	Family All 15
BDU FSTEC	The vulnerability of the Oracle Database Recovery Manager component of the Oracle Database Server database management system allows a perpetrator to trigger a service failure.	23 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-22077	18 Oct 202302:44	–	circl
CNNVD	Oracle Database Server Security Vulnerability	17 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-22077	17 Oct 202321:02	–	cvelist
EUVD	EUVD-2023-26242	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Oracle Database Server	19 Oct 202300:00	–	ncsc
NVD	CVE-2023-22077	17 Oct 202322:15	–	nvd
Oracle	Oracle Critical Patch Update Advisory - October 2023	17 Oct 202300:00	–	oracle
Tenable Nessus	Oracle Database Server (October 2023 CPU)	20 Oct 202300:00	–	nessus
OSV	CVE-2023-22077	17 Oct 202322:15	–	osv

NVD

Vulners

Node

oracle database_serverRange19.3–19.20enterprise

oracle database_serverRange21.3–21.11enterprise

[
  {
    "vendor": "Oracle Corporation",
    "product": "Database - Enterprise Edition",
    "versions": [
      {
        "version": "19.3",
        "status": "affected",
        "lessThanOrEqual": "19.20",
        "versionType": "custom"
      },
      {
        "version": "21.3",
        "status": "affected",
        "lessThanOrEqual": "21.11",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/security-alerts/cpuoct2023.html

Parameter	Position	Path	Description	CWE
'/opt/oracle/product/19c/dbhome_1/dbs/spfileORCLCDB.ora'	nested	/opt/oracle/product/19c/dbhome_1/dbs/spfileORCLCDB.ora	Path used in PoC to delete a critical server parameter/spfile via SYSBACKUP_RESTORE.deletefile, illustrating potential DoS by manipulating startup configuration.
/opt/oracle/product/19c/dbhome_1/dbs/	path	/opt/oracle/product/19c/dbhome_1/dbs/	Directory targeted for UTL_FILE operations in PoC, enabling file system manipulation that could contribute to denial of service or data loss.

17 Jun 2026 05:34Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.14.9

EPSS0.0058

SSVC