CVE-2023-21890
Reported by oracle · Published January 17, 2023
Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versions that are affected are 7.1.0 and 8.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via UDP to compromise Oracle Communications Converged Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Oracle Corporation | Communications Converged Application Server | 7.1.0, 8.0.0 |
| Oracle Corporation | Communications Converged Application Server | 7.1.0, 8.0.0 |
Timeline
- Jan 17, 2023 CVE Published
- Jan 18, 2023 EPSS Score (30 in total, the first dated here)
- Feb 22, 2026 CVE Updated
- May 19, 2026 Coalition ESS Score
- Jun 2, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-21890
vulnetix vdb fixes CVE-2023-21890Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-21890/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- Oracle Advisory vendor-advisory