Oracle Database Server XML Database Component Vulnerability Allowing Unauthorized Data Access and Modification

A vulnerability has been identified in the XML Database component of Oracle Database Server. This issue affects versions 19.3 through 19.26, 21.3 through 21.17, and 23.4 through 23.7. The vulnerability allows a low-privileged attacker with User Account privileges and network access via HTTP to compromise XML Database. Exploitation of this vulnerability requires human interaction from a third party. While the vulnerability resides within XML Database, successful attacks could significantly impact additional products, leading to a scope change. Exploitation of this vulnerability could result in unauthorized read access to certain XML Database data, as well as unauthorized updates, inserts, or deletions of accessible data.

Impact

Exploitation of this vulnerability could allow for unauthorized read, write, or delete access to some data within XML Database, with potential significant impacts on additional products.