CVE-2023-21932

published 2023-04-18

CVE-2023-21932: Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI). The supported version that is…

Priority P2 76 high 7.2 CVSS 3.1

AV N AC H PR H UI N S C C H I L A L

ITW VulnCheck KEV

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI). The supported version that is affected is 5.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. While the vulnerability is in Oracle Hospitality OPERA 5 Property Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality OPERA 5 Property Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
oracle	hospitality_opera_5_property_services	—	—
oracle_corporation	hospitality_opera_5_property_services	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /Operajserv/webarchive/FileReceiver?filename=↗

path \MICROS\↗

command POST /Operajserv/webarchive/FileReceiver?filename=<drive>:\MICROS\...&jndiname=...&username=...↗

• → Exploit targets HTTP POST requests to the /Operajserv/webarchive/FileReceiver endpoint with a filename parameter pointing to a Windows path under \MICROS\, combined with jndiname and username parameters — all three must be present. ↗
• → Exploit requests use multipart/form-data content type; inspect for this alongside the malicious URI pattern. ↗
• → The filename parameter value matches a Windows absolute path pattern (drive letter + colon + backslash + MICROS + backslash), indicating a path traversal/file write attempt on the OPERA 5 server. ↗
• → External reference for full exploit analysis and PoC details available at blog.assetnote.io. ↗

• · The Emerging Threats rule (sid:2045307) is marked with confidence:Low — tune carefully to avoid false positives before deploying in blocking mode. ↗
• · The vulnerability is rated High complexity (AC:H) and requires high privileges (PR:H), meaning exploitation is not trivial and requires a pre-authenticated, privileged attacker over the network. ↗
• · Scope change (S:C) is indicated — successful exploitation can impact systems beyond the directly vulnerable Oracle Hospitality OPERA 5 Property Services instance. ↗
• · Only version 5.6 of Oracle Hospitality OPERA 5 Property Services is confirmed affected; scope detection rules to relevant assets. ↗

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

vulncheck 7.2 HIGH

vendor_oracle 7.2 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.