CVE-2023-21824: 
Oracle Communications CNC Policy vulnerability analysis and mitigation

CVE-2023-21824 is a vulnerability in the Oracle Communications BRM - Elastic Charging Engine product, affecting versions 12.0.0.3.0 through 12.0.0.7.0. The vulnerability was disclosed in Oracle's January 2023 Critical Patch Update (Oracle Advisory).

This vulnerability allows high-privileged attackers with logon access to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to potentially compromise the system. The vulnerability has a CVSS 3.1 Base Score of 4.4 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating local access required, low attack complexity, high privileges required, no user interaction needed, and impacts only to confidentiality (NVD).

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. The impact is primarily focused on confidentiality, with no direct effects on integrity or availability (Oracle Advisory).

The vulnerability is described as easily exploitable, but requires high privileges and local access to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes (NVD).

Oracle has released patches to address this vulnerability as part of its January 2023 Critical Patch Update. Users are strongly advised to install these security patches without delay to protect against potential exploitation (Oracle Advisory).