Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-21251: Oracle Database Server: Unauthorized Data Access Through Java VM

CVE-2024-21251 · published 2 years ago

Summary

Oracle Database Server versions 19.3-23.5 have a security weakness that could allow an attacker to make unauthorized changes to data stored on the server. This requires the attacker to have some privileges and network access. To protect your data, you should update to the latest version of Oracle Database Server as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	database_server	>= 19.3, <= 19.24 >= 21.3, <= 21.15 >= 23.4, <= 23.5 `cpe:2.3:a:oracle:database_server::::::::`

Original advisory text

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Difficult to exploit vulnerability allows low priv...

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java VM accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).

References

https://www.oracle.com/security-alerts/cpuoct2024.html Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-203Observable Discrepancy

Timeline

Published15 Oct 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-21251 · NVD

Track software like this

Free during beta