Exploitable Vulnerability in Oracle Hospitality Reporting and Analytics by Oracle
CVE-2023-21826

7.6HIGH

Key Information:

Vendor
Oracle
Status
Hospitality Reporting and Analytics
Vendor
CVE Published:
18 January 2023

Summary

A vulnerability in Oracle Hospitality Reporting and Analytics allows low-privileged attackers with network access via HTTPS to potentially compromise the system. Successful exploitation can lead to unauthorized access to sensitive data, providing attackers with the ability to update, insert, or delete accessible data. This vulnerability also enables attackers to trigger denial of service conditions, causing the application to crash or hang. Note that user interaction is required from a third party, making it crucial for users to remain vigilant.

Affected Version(s)

Hospitality Reporting and Analytics 9.1.0

References

https://www.oracle.com/security-alerts/cpujan2023.html
vendor-advisory

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.