CVE-2023-21893 Component takeover in Oracle Data Provider for .NET
An unauthenticated attacker can compromise the Oracle Data Provider for .NET via network access, leading to full system takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-21893?
CVE-2023-21893 is a high-severity authentication bypass vulnerability in Oracle Database Server, published on 17 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Weakness: CWE-284
Which versions are affected by CVE-2023-21893?
8 open source packages ship an affected version, including Oracle.ManagedDataAccess and Oracle.ManagedDataAccess.Core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Oracle.ManagedDataAccess NuGet | From 19.0.0 | 19.18.0 |
Oracle.ManagedDataAccess NuGet | From 19.0.0 | 19.18.0 |
Oracle.ManagedDataAccess NuGet | From 21.0.0 | 21.9.0 |
Oracle.ManagedDataAccess NuGet | From 21.0.0 | 21.9.0 |
Oracle.ManagedDataAccess.Core NuGet | From 2.19.0 | 2.19.180 |
Oracle.ManagedDataAccess.Core NuGet | From 2.19.0 | 2.19.180 |
2 more packages
Oracle.ManagedDataAccess.Core NuGet | From 3.21.0 | 3.21.90 |
Oracle.ManagedDataAccess.Core NuGet | From 3.21.0 | 3.21.90 |
Products include Oracle Database Server.
How do I fix CVE-2023-21893?
Upgrade Oracle.ManagedDataAccess to a fixed version for your release line: 19.18.0 or 21.9.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-21893 being exploited?
There is no known exploitation of CVE-2023-21893 in the wild and no public exploit code.
Other vulnerabilities in Oracle Database Server
Sources
Also known as GHSA-5pm2-9mr2-3frq.