Vulnerability in Oracle Health Sciences InForm Product by Oracle
CVE-2023-21921

5.4MEDIUM

Key Information:

Vendor
Oracle
Status
Health Sciences Inform
Vendor
CVE Published:
18 April 2023

Summary

An improper access control vulnerability exists in the Oracle Health Sciences InForm product, enabling an attacker with low privileges and network access through HTTP to exploit the system. This can lead to unauthorized updates, insertion, or deletion of data, as well as unauthorized reading of sensitive information within the application. The vulnerability affects versions prior to 6.3.1.3 and 7.0.0.1, exposing institutions to significant risks regarding the confidentiality and integrity of their data.

Affected Version(s)

Health Sciences InForm * < 6.3.1.3

Health Sciences InForm * < 7.0.0.1

References

https://www.oracle.com/security-alerts/cpuapr2023.html
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.