Vulnerability in Oracle FLEXCUBE Universal Banking by Oracle
CVE-2023-22119

5.9MEDIUM

Key Information:

Vendor
Oracle
Status
Flexcube Universal Banking
Vendor
CVE Published:
17 October 2023

Summary

An issue has been identified in Oracle FLEXCUBE Universal Banking, affecting versions 12.3, 12.4, and 14.0 to 14.7. This vulnerability allows a low privileged attacker with network access via HTTP to compromise the system, but it requires human interaction from a third party to succeed. If exploited, this vulnerability can lead to unauthorized access to sensitive data, permitting attackers to perform unauthorized operations such as updating, inserting, or deleting accessible data. Additionally, it poses a risk of causing a partial denial of service affecting Oracle FLEXCUBE operations.

Affected Version(s)

FLEXCUBE Universal Banking 12.3

FLEXCUBE Universal Banking 12.4

FLEXCUBE Universal Banking 14.0 <= 14.3

References

https://www.oracle.com/security-alerts/cpuoct2023.html
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.