Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.6
CVE-2023-21983: Oracle Application Express Admin Data Tampering and Denial of Service
CVE-2023-21983 · published 3 years ago
Summary
A weakness in Oracle Application Express Administrator allows an attacker to access or modify sensitive data without permission, potentially causing a partial service disruption. This affects Oracle Application Express versions 18.2 to 22.2. It's essential to update to a fixed version to prevent unauthorized data access and service disruptions.
Original advisory text
Vulnerability in the Application Express Administration product of Oracle Application Express (component: None). Supported versions that are affected are Application Express Administration: 18.2-2...
Vulnerability in the Application Express Administration product of Oracle Application Express (component: None). Supported versions that are affected are Application Express Administration: 18.2-22.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Express Administration. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Express Administration accessible data as well as unauthorized read access to a subset of Application Express Administration accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Application Express Administration. CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Timeline
Published18 Jul 2023
Updated4 Nov 2026
First seen11 Mar 2026
Track software like this
Free during beta