// For flags

CVE-2023-22087

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in takeover of Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Vulnerabilidad en el producto Hospitality OPERA 5 Property Services de Oracle Hospitality Applications (componente: Opera). La versión soportada afectada es la 5.6. Una vulnerabilidad fácilmente explotable permite a un atacante con pocos privilegios y acceso a la red a través de HTTP comprometer los servicios de propiedad de Hospitality OPERA 5. Los ataques exitosos a esta vulnerabilidad pueden resultar en la adquisición de Hospitality OPERA 5 Property Services. CVSS 3.1 Puntuación base 8,8 (impactos en la confidencialidad, la integridad y la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2022-12-17 CVE Reserved
  • 2023-10-17 CVE Published
  • 2024-09-13 CVE Updated
  • 2024-10-23 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-306: Missing Authentication for Critical Function
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
https://www.oracle.com/security-alerts/cpuoct2023.html 2023-10-23
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
 Hospitality Opera 5 Property Services
Search vendor "Oracle" for product "Hospitality Opera 5 Property Services"
 5.6
Search vendor "Oracle" for product "Hospitality Opera 5 Property Services" and version "5.6"
-
Affected