CVE-2023-21834

MEDIUM

Oracle E-Business Suite <12.2.13 - Unauthorized Update

Title source: llm

Description

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workflow, Approval, Work Force Management). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Self-Service Human Resources. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Self-Service Human Resources accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

References (1)

Core 1

Core References

Patch, Vendor Advisory vendor-advisory

https://www.oracle.com/security-alerts/cpujan2023.html

Scores

CVSS v3 4.3

EPSS 0.0022

EPSS Percentile 44.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

Status published

Products (1)

oracle/self-service_human_resources 12.2.3 - 12.2.12

Published Jan 18, 2023

Tracked Since Feb 18, 2026