cbcvebase.
CVE-2021-2205
published 2021-04-22

CVE-2021-2205: Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are…

PriorityP262critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
1.55%
72.3th percentile
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.7-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized access to critical data or complete access to all Oracle Marketing accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Affected

2 ranges
VendorProductVersion rangeFixed in
oraclemarketing12.2.7 – 12.2.10—
oracle_corporationmarketing——

Detection & IOCsextracted from sources · hover to see the quote

  • →The vulnerability is remotely exploitable over HTTP with no authentication required, targeting Oracle E-Business Suite Marketing Administration component — monitor for unauthenticated HTTP requests to Oracle Marketing Administration endpoints on affected versions (12.2.7–12.2.10) ↗
  • ·Affected versions are Oracle E-Business Suite Marketing Administration 12.2.7 through 12.2.10 only; versions outside this range are not listed as affected ↗
  • ·Attack vector is network (HTTP), with no privileges or user interaction required, making this exploitable from any network-accessible position — ensure Oracle Marketing Administration is not exposed to untrusted networks ↗

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vendor_oracle9.1CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.