Loading...
Skip to main content
GeekWala

CVE-2023-21893 — Component takeover in Oracle.ManagedDataAccess —...

HIGH

Component takeover in Oracle Data Provider for .NET

Published January 18, 2023Updated September 17, 2024Source: osv

Summary

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). See the readme.txt files inside the `.nupkg` packages for a reference to the fix.

Advisory Timeline

  • First published January 18, 2023 (1363 days ago).
  • Last revised September 17, 2024 — 609 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update Oracle.ManagedDataAccess to 21.9.0 or later
dotnet add package Oracle.ManagedDataAccess --version 21.9.0
NuGet
Update Oracle.ManagedDataAccess.Core to 3.21.90 or later
dotnet add package Oracle.ManagedDataAccess.Core --version 3.21.90
NuGet
Update Oracle.ManagedDataAccess to 19.18.0 or later
dotnet add package Oracle.ManagedDataAccess --version 19.18.0
NuGet
Update Oracle.ManagedDataAccess.Core to 2.19.180 or later
dotnet add package Oracle.ManagedDataAccess.Core --version 2.19.180

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: nuget (2).

PackageEcosystemAffectedFixed In
Oracle.ManagedDataAccess
nuget
21.3.0, 21.4.0, 21.5.0, 21.6.1 (+2 more)21.9.0
Oracle.ManagedDataAccess.Core
nuget
3.21.1, 3.21.3, 3.21.4, 3.21.41 (+4 more)3.21.90
Oracle.ManagedDataAccess
nuget
19.10.0, 19.10.1, 19.11.0, 19.12.0 (+12 more)19.18.0
Oracle.ManagedDataAccess.Core
nuget
2.19.100, 2.19.101, 2.19.110, 2.19.120 (+14 more)2.19.180

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-21893?
Component takeover in Oracle Data Provider for .NET This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2023-21893?
CVE-2023-21893 affects Oracle.ManagedDataAccess and Oracle.ManagedDataAccess.Core. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-21893 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-5pm2-9mr2-3frq

Related CVEs

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies