SQL Injection Vulnerability in Oracle Database Server's Application Express Component

CVE-2020-2973

Summary

A vulnerability exists in the Oracle Application Express component of Oracle Database Server that allows a low-privileged attacker, with SQL Workshop privileges, to exploit the system through network access via HTTP. This easily exploitable vulnerability requires human interaction from an external user, raising the risk of unauthorized access. Successful exploitation may enable the attacker to perform unauthorized updates, inserts, or deletions of data accessible through Oracle Application Express, as well as to retrieve confidential information. While the primary target is the Application Express component, the effects may extend to other products within the Oracle ecosystem, increasing the overall risk to database integrity and confidentiality.

References