WaratekVRT Sign in

CVE-2023-21932 Oracle Hospitality OPERA 5 Property Services

Affected softwareOracle Hospitality OPERA 5 Property Services
Affected versions5.6
Severity7.2 High CVSS 3.1
Fixed inOracle Critical Patch Update April 2023
Published18 Apr 2023
Updated17 Jun 2026

Description

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI). The supported version that is affected is 5.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. While the vulnerability is in Oracle Hospitality OPERA 5 Property Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality OPERA 5 Property Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L).

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · earliest 2024-07-25.
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 45% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2023-21932 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation cisa.gov /sites/default/files/2024-07/aa24-207a-dprk-cyber-group-conducts-global-espionage-campaign.pdf 2024-07-25

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection unknown
  • Action not assessed
  • Review automated Upstream data
  • Record active
Decided by Somebody exploiting this CVE (a CISA or VulnCheck KEV listing, or a CISA verdict of active exploitation), with no fix, source code or PoC to build a rule from
Finding VulnCheck KEV reports exploitation (1 written report(s), earliest 2024-07-25). VRT found no upstream fix and no open-source Maven package, and no PoC is published, so there is nothing to build an ARMR rule from yet. No rule exists and none is planned. Nobody has checked whether an existing ARMR rule already blocks it.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Hospitality Applications / OXI (5.6)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Hospitality Applications OXI 5.6 5.6

Products and versions

1 product, 1 version entry
SourceVendorProductSchemeAffected versions
nvd oracle hospitality opera 5 property services generic 5.6

References

URLTags
https://www.oracle.com/security-alerts/cpuapr2023.html Vendor Advisory

Timeline
Published2023-04-18By the CVE Program.
VulnCheck KEV: earliest evidence2024-07-25Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.