CVE-2023-33201 in Utilties Application Framework

Summary

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Reservation

05/18/2023

Disclosure

07/05/2023

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
251321	Oracle Utilties Application Framework General information disclosure	200	Not defined	Official fix	CVE-2023-33201
251198	Oracle WebCenter Sites Third Party information disclosure	200	Not defined	Official fix	CVE-2023-33201
251197	Oracle WebCenter Portal Security information disclosure	200	Not defined	Official fix	CVE-2023-33201
251196	Oracle Managed File Transfer MFT Runtime Server information disclosure	200	Not defined	Official fix	CVE-2023-33201
251160	Oracle Financial Services Revenue Management and Billing Infrastructure information disclosure	200	Not defined	Official fix	CVE-2023-33201
251159	Oracle Financial Services Lending and Leasing Internal Operations information disclosure	200	Not defined	Official fix	CVE-2023-33201
251158	Oracle Banking Virtual Account Management Common Core information disclosure	200	Not defined	Official fix	CVE-2023-33201
251157	Oracle Banking Extensibility Workbench Infrastructure information disclosure	200	Not defined	Official fix	CVE-2023-33201
251156	Oracle Banking Corporate Lending Process Management Base information disclosure	200	Not defined	Official fix	CVE-2023-33201
251089	Oracle Enterprise Manager Base Platform OCI information disclosure	200	Not defined	Official fix	CVE-2023-33201
251048	Oracle Communications Cloud Native Core Network Repository Function Install/Upgrade information disclosure	200	Not defined	Official fix	CVE-2023-33201
250997	Oracle Communications Service Catalog and Design PSR Designer information disclosure	200	Not defined	Official fix	CVE-2023-33201
250995	Oracle Communications Messaging Server Security information disclosure	200	Not defined	Official fix	CVE-2023-33201
242678	Oracle Banking Trade Finance Process Management Dashboard information disclosure	200	Not defined	Official fix	CVE-2023-33201
242676	Oracle Banking Supply Chain Finance Security information disclosure	200	Not defined	Official fix	CVE-2023-33201
242674	Oracle Banking Origination Onboarding Batch Processes information disclosure	200	Not defined	Official fix	CVE-2023-33201
242672	Oracle Banking Liquidity Management Common information disclosure	200	Not defined	Official fix	CVE-2023-33201
242670	Oracle Banking Electronic Data Exchange for Corporates Reports information disclosure	200	Not defined	Official fix	CVE-2023-33201
242668	Oracle Banking Digital Experience UI information disclosure	200	Not defined	Official fix	CVE-2023-33201
242667	Oracle Banking Credit Facilities Process Management Common information disclosure	200	Not defined	Official fix	CVE-2023-33201
242665	Oracle Banking Cash Management Accessibility information disclosure	200	Not defined	Official fix	CVE-2023-33201
242663	Oracle Banking Branch Reports information disclosure	200	Not defined	Official fix	CVE-2023-33201
242662	Oracle Banking APIs IDM Authentication information disclosure	200	Not defined	Official fix	CVE-2023-33201
242560	Oracle Communications Session Report Manager General information disclosure	200	Not defined	Official fix	CVE-2023-33201
242558	Oracle Communications Element Manager General information disclosure	200	Not defined	Official fix	CVE-2023-33201
231726	bouncycastle Self-Signed Certificate X509LDAPCertStoreSpi.java ldap injection	90	Not defined	Official fix	CVE-2023-33201

Sources

• MITRE
• NVD
• CVE Details