TI-2023-08341 Aliases CVE-2023-21969 GHSA-grrp-hf9w-3vjm

Improper access control in Oracle SQL Developer

LOW 31CWE-284Published 2023-04-18 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Vulnerability in Oracle SQL Developer (component: Installation). Supported versions that are affected are Prior to 23.1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle SQL Developer executes to compromise Oracle SQL Developer. Successful attacks of this vulnerability can result in takeover of Oracle SQL Developer. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00221 12th percentileScored 2026-11-07

Fix Fixed SQL Developer (Oracle Corporation): 23.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Oracle	SQL Developer	before 23.1.0	23.1.0	Patch available	CNA

SQL Developer VendorOracle Affected before 23.1.0 Fixed in 23.1.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:oracle:sql_developer::::::::	before 23.1.0	Vulnerable	Oracle

cpe:2.3:a:oracle:sql_developer:*:*:*:*:*:*:*:* Versions before 23.1.0 Vulnerable ·Oracle

Remediation

Fix · CNA SQL Developer (Oracle Corporation) Fixed in 23.1.0

Timeline

2026-10-02 Threatist record created from CVE-2023-21969
2026-10-03 Alias added: GHSA-grrp-hf9w-3vjm

References

Advisory 1

Oracle Advisory

TI-2021-20437 Apache Log4j2 does not always protect from infinite recursion in lookup evaluation CVSS 3.1MEDIUM 5.9
TI-2020-10932 Improper input validation in Apache HttpClient CVSS 3.1MEDIUM 5.3
TI-2020-11580 Vulnerability in the SQL Developer Install component of Oracle Database Server. CVSS 3.1LOW 2.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences