7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-21893

GHSA ID

GHSA-5pm2-9mr2-3frq

EPSS Score

0.71698%

CWE

CWE-284

Published

1/18/2023

Updated

9/17/2024

KEV Status

Technology

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-21893

CVE-2023-21893: Component takeover in Oracle Data Provider for .NET

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

See the readme.txt files inside the .nupkg packages for a reference to the fix.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-21893

CVE-2023-21893:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-21893

GHSA ID

GHSA-5pm2-9mr2-3frq

EPSS Score

0.71698%

CWE

CWE-284

Published

1/18/2023

Updated

9/17/2024

KEV Status

Technology

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Oracle.ManagedDataAccess	nuget	>= 21.0.0, < 21.9.0	21.9.0
Oracle.ManagedDataAccess.Core	nuget	>= 3.21.0, < 3.21.90	3.21.90
Oracle.ManagedDataAccess	nuget	>= 19.0.0, < 19.18.0	19.18.0
Oracle.ManagedDataAccess.Core	nuget	>= 2.19.0, < 2.19.180	2.19.180

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability involves improper access control in TCPS handling. Analysis focused on:

Connection initialization entry points (Open method)
Low-level network transport layer (TcpTransport)
Security configuration validation While exact patch changes aren't visible, Oracle's advisory specifies TCPS network access as the vector. These functions directly handle secure connection setup and would require access control validation improvements. The high confidence in OracleConnection.Open stems from its role as primary connection entry point requiring proper security context validation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-21893: Component takeover in Oracle Data Provider for .NET

CVE-2023-21893:

7.5

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Detect and Respond To Threats Faster.

CVE-2023-21893: Component takeover in Oracle Data Provider for .NET

Basic Information

Basic Information

7.5

7.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-21893: Component takeover in Oracle Data Provider for .NET

CVE-2023-21893:

7.5

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

CVE-2023-21893: Component takeover in Oracle Data Provider for .NET

Basic Information

Basic Information

7.5

7.5

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI