Roger Meyer

Name of the Vulnerable Software and Affected Versions: Oracle REST Data Services versions 11.2.0.4 through 19c Standalone ORDS versions prior to 20.2.1 Description: The issue is related to security mechanism errors in the General component of Oracle REST Data Services. It allows a low-privileged attacker with network access via HTTP to compromise Oracle REST Data Services, resulting in unauthorized read access to a subset of Oracle REST Data Services accessible data. Recommendations: For Oracle REST Data Services versions 11.2.0.4 through 19c, update to a version later than 19c or apply the necessary patch. For Standalone ORDS versions prior to 20.2.1, update to version 20.2.1 or later. As a temporary workaround, consider restricting access to the HTTP endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle Application Express versions 5.1 through 19.2 **Description** The issue is related to insufficient input validation in the Oracle Application Express component of Oracle Database Server. It allows a low-privileged attacker with SQL Workshop privilege and network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and can significantly impact additional products. This can result in unauthorized update, insert, or delete access to some of Oracle Application Express's accessible data, as well as unauthorized read access to a subset of Oracle Application Express's accessible data. **Recommendations** For versions 5.1 through 19.2, consider restricting access to the SQL Workshop privilege to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the use of HTTP network access to reduce the vulnerability to attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Application Express versions 5.1 through 19.2 **Description** The issue exists due to insufficient input validation in the Oracle Application Express component of Oracle Database Server. Exploitation of this issue may allow a remote attacker to gain unauthorized access to modify, add, or delete data, or access protected information via the HTTP protocol. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The attacks can result in unauthorized update, insert, or delete access to some of Oracle Application Express's accessible data, as well as unauthorized read access to a subset of Oracle Application Express's accessible data. **Recommendations** For versions 5.1 through 19.2, consider restricting access to the SQL Workshop privilege to minimize the risk of exploitation. As a temporary workaround, limit network access via HTTP to the Oracle Application Express component until a patch is available. Avoid relying on human interaction that may facilitate the attack.

**Name of the Vulnerable Software and Affected Versions** Oracle Application Express versions 5.1 through 19.2 **Description** The issue is related to insufficient input validation in the Oracle Application Express component of Oracle Database Server. It allows a low-privileged attacker with SQL Workshop privilege and network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some of Oracle Application Express's accessible data, as well as unauthorized read access to a subset of Oracle Application Express's accessible data. **Recommendations** For versions 5.1 through 19.2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the SQL Workshop privilege to minimize the risk of exploitation. Additionally, restrict network access via HTTP to the Oracle Application Express component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle Application Express versions 5.1 through 19.2 **Description** The issue is related to insufficient input validation in the Oracle Application Express component of Oracle Database Server. It allows a low-privileged attacker with SQL Workshop privilege and network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some of Oracle Application Express's accessible data, as well as unauthorized read access to a subset of Oracle Application Express's accessible data. **Recommendations** For versions 5.1 through 19.2, consider restricting access to the SQL Workshop privilege to minimize the risk of exploitation. As a temporary workaround, limit the use of HTTP network access to Oracle Application Express until a patch is available. Avoid using the vulnerable component of Oracle Application Express until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Application Express versions 5.1 through 19.2 **Description** The issue is related to insufficient input validation in the Oracle Application Express component of Oracle Database Server. It allows a low-privileged attacker with SQL Workshop privilege and network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some of Oracle Application Express's accessible data, as well as unauthorized read access to a subset of Oracle Application Express's accessible data. **Recommendations** For versions 5.1 through 19.2, consider restricting access to the SQL Workshop privilege to minimize the risk of exploitation. As a temporary workaround, limit network access via HTTP to the Oracle Application Express component until a patch is available. Avoid using the Oracle Application Express component for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Database Server versions 5.1 through 19.2 **Description** The issue exists due to insufficient input validation in the SQL Workshop component of Oracle Database Server. This allows a remote attacker with SQL Workshop privilege and network access via HTTP to potentially gain unauthorized access to modify, add, or delete data, or to access protected information. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products, resulting in unauthorized update, insert, or delete access to some data, as well as unauthorized read access to a subset of data. **Recommendations** For versions 5.1 through 19.2, consider restricting access to the SQL Workshop component until a fix is available. As a temporary workaround, limit network access via HTTP to the Oracle Application Express component to minimize the risk of exploitation. Avoid using the SQL Workshop privilege for non-essential operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Application Express versions 5.1 through 19.2 **Description** The issue exists due to insufficient input validation in the Oracle Application Express component of Oracle Database Server. Exploitation of this issue may allow a remote attacker to gain unauthorized access to modify, add, or delete data, or to access protected information via the HTTP protocol. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The attacks can result in unauthorized update, insert, or delete access to some of Oracle Application Express's accessible data, as well as unauthorized read access to a subset of Oracle Application Express's accessible data. **Recommendations** For versions 5.1 through 19.2, consider restricting access to the SQL Workshop privilege to minimize the risk of exploitation, and ensure that all users with this privilege are trusted and monitored. As a temporary workaround, consider disabling the HTTP access to Oracle Application Express until a patch is available. Restrict network access via HTTP to the Oracle Application Express component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle Application Express versions prior to 19.2 **Description** The issue is related to inadequate access control in the Oracle Application Express component of Oracle Database Server. It allows a low-privileged attacker with network access via HTTPS to compromise Oracle Application Express, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized update, insert, or delete access to some of Oracle Application Express's accessible data and unauthorized ability to cause a partial denial of service of Oracle Application Express. **Recommendations** For versions prior to 19.2, update to version 19.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Oracle Application Express component to minimize the risk of exploitation. Additionally, restrict network access via HTTPS to only necessary users to reduce the attack surface.