| CVE ID | CVE-2023-21893 |
| CVSS SCORE | 6.8, AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| AFFECTED VENDORS |
Oracle |
| AFFECTED PRODUCTS |
ODP.NET Managed Driver |
| VULNERABILITY DETAILS |
This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of Oracle ODP.NET Managed Driver. An attacker must first obtain the ability to intercept and alter network traffic in order to exploit this vulnerability. The specific flaw exists within the ValidateRemoteCertificate function. The issue results from the lack of proper validation of the server certificate. An attacker can leverage this vulnerability to disclose communications between the client and the server or to insert fraudulent server responses. |
| ADDITIONAL DETAILS |
Oracle has issued an update to correct this vulnerability. More details can be found at:
https://www.oracle.com/security-alerts/cpujan2023.html |
| DISCLOSURE TIMELINE |
|
| CREDIT | Georg Jung |
