Component takeover in Oracle Data Provider for .NET

2023-01-1800:30:16

CWE-284

GitHub Advisory Database

github.com

oracle database server

vulnerability

19c

21c

tcps

unauthenticated attacker

network access

takeover

database client-only

windows platform

cvss 3.1

confidentiality

integrity

availability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.005

Percentile

75.6%

JSON

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

See the readme.txt files inside the .nupkg packages for a reference to the fix.

Affected configurations

Vulners

Node

oracle.manageddataaccess.coreRange2.19.0–2.19.180

oracle.manageddataaccessRange19.0.0–19.18.0

oracle.manageddataaccess.coreRange3.21.0–3.21.90

oracle.manageddataaccessRange21.0.0–21.9.0

VendorProductVersionCPE
*oracle.manageddataaccess.core*cpe:2.3:a:*:oracle.manageddataaccess.core:*:*:*:*:*:*:*:*
*oracle.manageddataaccess*cpe:2.3:a:*:oracle.manageddataaccess:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	oracle.manageddataaccess.core	*	cpe:2.3:a::oracle.manageddataaccess.core::::::::*
*	oracle.manageddataaccess	*	cpe:2.3:a::oracle.manageddataaccess::::::::*