Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2023-21893 - High Severity Vulnerability
Oracle Data Provider for .NET Core for Oracle Database
Library home page: https://api.nuget.org/packages/oracle.manageddataaccess.core.2.19.3.nupkg
Path to dependency file: /MsTest.csproj
Path to vulnerable library: /GOUQDE/dotnet_KTZITF/20220524065603/oracle.manageddataaccess.core/2.19.3/oracle.manageddataaccess.core.2.19.3.nupkg
Dependency Hierarchy: - :x: **oracle.manageddataaccess.core.2.19.3.nupkg** (Vulnerable Library)
Found in HEAD commit: ac455098fc1780c550dc6636763265442a1d8020
Found in base branch: master
Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Publish Date: 2023-01-18
URL: CVE-2023-21893
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-5pm2-9mr2-3frq
Release Date: 2023-01-18
Fix Resolution: Oracle.ManagedDataAccess - 21.9.0, Oracle.ManagedDataAccess.Core - 3.21.90
:rescue_worker_helmet: Automatic Remediation is available for this issue