## Summary
Oracle Database RDBMS component contains a vulnerability that is easily exploitable by a low-privileged attacker with Execute on DBMS_REDEFINITION and network access via Oracle Net. Successful exploitation can lead to RDBMS takeover, impacting confidentiality, integrity, and availability.
## Technical Details
- Affected component: Oracle Database Server RDBMS component.
- Attack vector: NETWORK (via Oracle Net).
- Required privileges: low-privileged attacker with Execute on DBMS_REDEFINITION.
- Exploitability characteristics (from NVD):
- AV:N (network reachable)
- AC:L (low attack complexity)
- PR:L (low privileges)
- UI:N (no user interaction)
- Impact scope: S:U (unchanged scope), with C:H, I:H, A:H.
## Affected
- Oracle Database Server versions:
- 19.3-19.32
- 21.3-21.23
- 23.4.0-23.26.3
## Impact
- RDBMS takeover.
- High impact to:
- Confidentiality (C:H)
- Integrity (I:H)
- Availability (A:H)
## Mitigation
1. Restrict and review grants of Execute on DBMS_REDEFINITION to ensure only explicitly required principals can use it.
2. Apply Oracle’s security updates/patches for the affected version ranges (19.3-19.32, 21.3-21.23, 23.4.0-23.26.3) as provided by Oracle.
3. Reduce exposure of Oracle Net services (network segmentation/firewalling) so only trusted clients can reach the database listener.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H