{"id":"CVE-2023-21909","state":"PUBLISHED","title":"Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework).  Supported versions that are affected are 23.3 and prior. Easily exploitable vulnerability a","description":"Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework).  Supported versions that are affected are 23.3 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","publishedAt":"2023-04-18T19:54:16.579Z","updatedAt":"2024-09-16T19:45:23.029Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"oracle"},"assigner":"oracle","products":["Oracle Corporation Siebel UI Framework"],"affected":[{"vendor":"Oracle Corporation","product":"Siebel UI Framework","versions":[{"version":"23.3 and prior","status":"affected"}]}],"references":["https://www.oracle.com/security-alerts/cpuapr2023.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/21xxx/CVE-2023-21909.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-21909","state":"PUBLISHED","datePublished":"2023-04-18T19:54:16.579Z","dateUpdated":"2024-09-16T19:45:23.029Z","assignerShortName":"oracle","assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","dateReserved":"2022-12-17T19:26:00.713Z"},"containers":{"cna":{"descriptions":[{"lang":"en-US","value":"Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework).  Supported versions that are affected are 23.3 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."}],"affected":[{"vendor":"Oracle Corporation","product":"Siebel UI Framework","versions":[{"version":"23.3 and prior","status":"affected"}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2023.html","name":"Oracle Advisory","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en-US","description":"Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM accessible data."}]}],"providerMetadata":{"shortName":"oracle","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","dateUpdated":"2023-04-18T19:54:16.579Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2023.html","name":"Oracle Advisory","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T09:51:51.463Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-16T19:39:46.635361Z","id":"CVE-2023-21909","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-16T19:45:23.029Z"}}]}}}