Oracle E-Business Suite: CVE-2023-21825: Critical Patch Update

Oracle E-Business Suite: CVE-2023-21825: Critical Patch Update

Severity

5

CVSS

(AV:N/AC:L/Au:N/C:P/I:N/A:N)

Published

01/18/2023

Created

01/27/2023

Added

01/27/2023

Modified

01/28/2025

Description

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Supplier Management).Supported versions that are affected are 12.2.6-12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal.Successful attacks of this vulnerability can result inunauthorized read access to a subset of Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Solution(s)

• oracle-ebs-12_2_6-apply-patch-34870379
• oracle-ebs-12_2_7-apply-patch-34870379
• oracle-ebs-12_2_8-apply-patch-34870379
• oracle-ebs-jan-2023-cpu-12_2

References

• https://attackerkb.com/topics/cve-2023-21825
• CVE - 2023-21825
• https://support.oracle.com/epmos/faces/DocumentDisplay?id=2916871.1
• https://www.oracle.com/security-alerts/cpujan2023.html