Unauthorized Access Risk in Oracle Health Sciences InForm by Oracle
CVE-2023-21926

5.5MEDIUM

Key Information:

Vendor
Oracle
Status
Health Sciences Inform
Vendor
CVE Published:
18 April 2023

Summary

The Oracle Health Sciences InForm product is vulnerable due to weak security measures, allowing unauthenticated attackers with logon access to the infrastructure to compromise the application. Attackers may exploit this vulnerability through social engineering, necessitating some form of human interaction for successful attacks. Affected users might face unauthorized access to sensitive data, resulting in significant confidentiality breaches.

Affected Version(s)

Health Sciences InForm * < 6.3.1.3

Health Sciences InForm * < 7.0.0.1

References

https://www.oracle.com/security-alerts/cpuapr2023.html
vendor-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.