Critical Network Vulnerability in Oracle Communications Converged Application Server
CVE-2023-21890

9.8CRITICAL

Key Information:

Vendor

Oracle
Status
Communications Converged Application Server
Vendor
CVE Published:
18 January 2023

What is CVE-2023-21890?

A serious vulnerability exists in the Oracle Communications Converged Application Server, where an unauthenticated attacker can exploit the server via UDP network access. This flaw affects versions 7.1.0 and 8.0.0, allowing attackers to potentially take control of the system. If successfully exploited, the vulnerability can significantly compromise the confidentiality, integrity, and availability of the server, posing a major risk to organizations utilizing Oracle's communication products.

Affected Version(s)

Communications Converged Application Server 7.1.0

Communications Converged Application Server 8.0.0

References

https://www.oracle.com/security-alerts/cpujan2023.html
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.