CVE-2023-21849: 
Oracle E-Business Suite vulnerability analysis and mitigation

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils) affects versions 12.2.3-12.2.12. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle Applications DBA. The vulnerability was disclosed on January 17, 2023, as part of Oracle's Critical Patch Update (Oracle Advisory, NVD).

The vulnerability has been assigned a CVSS 3.1 Base Score of 7.5 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The scoring indicates that the vulnerability is network-accessible (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), requires no user interaction (UI:N), has unchanged scope (S:U), and impacts only integrity (I:H) with no effect on confidentiality or availability (Oracle Advisory).

Successful exploitation of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications DBA accessible data. The high integrity impact indicates that attackers can modify data in ways that could significantly affect the system (Oracle Advisory).

Oracle has released security patches for this vulnerability as part of their January 2023 Critical Patch Update. Organizations running affected versions (12.2.3-12.2.12) of Oracle Applications DBA should apply the security patches immediately. Oracle strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update security patches without delay (Oracle Advisory).