CVE-2023-21974

6 documents5 sources
Severity
9.0CRITICAL
EPSS
0.7%
top 27.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Oracle Corporation Application Express (apex)Oracle Application Express
Timeline
PublishedJul 18

Description

Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Team Calendar Plugin: 18.2-22.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Application Express Team Calendar Plugin. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application E…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HExploitability: 2.3 | Impact: 6.0

Affected Packages2 packages

▶NVDoracle/application_express18.2 — 22.1
▶CVEListV5oracle_corporation/application_express_(apex)Application Express Team Calendar Plugin: 18.2 — 22.1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-xw76-3w59-j73x: Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account)↗2023-07-18
▶
CVEList
CVE-2023-21974: Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account)↗2023-07-18
▶

📋Vendor Advisories

1
Oracle
Oracle Oracle Application Express Risk Matrix: User Account — CVE-2023-21974↗2023-07-15
▶