Oracle Goldengate
Monthly
Privilege escalation to full takeover in Oracle GoldenGate Service Manager lets a low-privileged attacker with HTTP network access fully compromise the product across versions 19.1.0.0.0-19.29.0.0, 21.3-21.21, and 23.4-23.26.1.0.0. Oracle rates this easily exploitable with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated information disclosure in Oracle GoldenGate versions 23.4 through 23.10 exposes a subset of accessible data to remote attackers via HTTP, requiring no credentials or user interaction. The Libraries component contains a CWE-200 flaw that allows network-based attackers to read protected data, though impact is limited to partial confidentiality - integrity and availability are unaffected. No active exploitation has been identified (not in CISA KEV), and EPSS places exploitation probability at 0.03%, consistent with the SSVC exploitation status of none despite the automatable flag.
Privilege escalation to full takeover in Oracle GoldenGate Service Manager lets a low-privileged attacker with HTTP network access fully compromise the product across versions 19.1.0.0.0-19.29.0.0, 21.3-21.21, and 23.4-23.26.1.0.0. Oracle rates this easily exploitable with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated information disclosure in Oracle GoldenGate versions 23.4 through 23.10 exposes a subset of accessible data to remote attackers via HTTP, requiring no credentials or user interaction. The Libraries component contains a CWE-200 flaw that allows network-based attackers to read protected data, though impact is limited to partial confidentiality - integrity and availability are unaffected. No active exploitation has been identified (not in CISA KEV), and EPSS places exploitation probability at 0.03%, consistent with the SSVC exploitation status of none despite the automatable flag.