CVE-2023-21824 Information disclosure in Communications BRM - Elastic Charging Engine
High-privileged attackers can access critical data in Oracle Communications BRM Elastic Charging Engine via local logon.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-21824?
CVE-2023-21824 is a medium-severity vulnerability in Oracle Communications Cloud Native Core Binding Support Function, published on 17 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Customer, Config, Pricing Manager). Supported versions that are affected are 12.0.0.3.0-12.0.0.7.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
Which versions are affected by CVE-2023-21824?
It affects 3 products.
Products include Oracle Communications Billing and Revenue Management Elastic Charging Engine, Oracle Communications Cloud Native Core Binding Support Function, Oracle Communications Cloud Native Core Policy.
How do I fix CVE-2023-21824?
No fix has been published for CVE-2023-21824 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-21824 being exploited?
There is no known exploitation of CVE-2023-21824 in the wild and no public exploit code.
Other vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
All Oracle Communications Cloud Native Core Binding Support Function vulnerabilities
Sources
Also known as GHSA-whgj-8gvh-f58r.