{"id":"CVE-2023-22019","state":"PUBLISHED","title":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vu","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","publishedAt":"2023-10-17T21:02:47.050Z","updatedAt":"2024-09-13T16:19:09.596Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"oracle"},"assigner":"oracle","products":["Oracle Corporation HTTP Server"],"affected":[{"vendor":"Oracle Corporation","product":"HTTP Server","versions":[{"version":"12.2.1.4.0","status":"affected"}]}],"references":["https://www.oracle.com/security-alerts/cpuoct2023.html"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/22xxx/CVE-2023-22019.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-22019","state":"PUBLISHED","datePublished":"2023-10-17T21:02:47.050Z","dateUpdated":"2024-09-13T16:19:09.596Z","assignerShortName":"oracle","assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","dateReserved":"2022-12-17T19:26:00.750Z"},"containers":{"cna":{"descriptions":[{"lang":"en-US","value":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}],"affected":[{"vendor":"Oracle Corporation","product":"HTTP Server","versions":[{"version":"12.2.1.4.0","status":"affected"}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2023.html","name":"Oracle Advisory","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en-US","description":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data."}]}],"providerMetadata":{"shortName":"oracle","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","dateUpdated":"2023-10-17T21:02:47.050Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2023.html","name":"Oracle Advisory","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T09:59:28.906Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-13T16:18:11.750031Z","id":"CVE-2023-22019","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","type":"CWE","lang":"en","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-13T16:19:09.596Z"}}]}}}