CVE-2024-21093
Assigner: oracle
Published: 2024-04-16T21:26:29.704Z
State: PUBLISHED
problemTypes: descriptions: description: Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Java VM accessible data.
affected: vendor: Oracle Corporation
product: Database - Enterprise Edition
cpes: cpe:2.3:a:oracle:database_-_java_vm:19.3-19.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_-_java_vm:21.3-21.13:*:*:*:*:*:*:*
versions: version: 19.3
status: affected
lessThanOrEqual: 19.22
versionType: custom
version: 21.3
status: affected
lessThanOrEqual: 21.13
versionType: custom
descriptions: value: Vulnerability in the Java VM component of Oracle Database Server.  Supported versions that are affected are 19.3-19.22 and  21.3-21.13. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Java VM accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
metrics: cvssV3_1: attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM