CVE-2021-2256

published 2021-04-22

CVE-2021-2256: Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supported version that is…

Priority P2 62 critical 10 CVSS 3.1

AV N AC L PR N UI N S C C H I H A H

Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supported version that is affected is Prior to 16.3.1.4.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Storage Cloud Software Appliance. While the vulnerability is in Oracle Storage Cloud Software Appliance, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Storage Cloud Software Appliance. Note: Updating the Oracle Storage Cloud Software Appliance to version 16.3.1.4.2 or later will address these vulnerabilities. Download the latest version of Oracle Storage Cloud Software Appliance from here. Refer to Document 2768897.1 for more details. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
oracle	storage_cloud_software_appliance	< 16.3.1.4.2	16.3.1.4.2
oracle_corporation	cloud_infrastructure	>= unspecified < 16.3.1.4.2	16.3.1.4.2

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerability is exploitable over HTTP with no authentication required and no user interaction, targeting the Management Console component of Oracle Storage Cloud Software Appliance prior to version 16.3.1.4.2. ↗
• → Scope change is confirmed (S:C in CVSS vector), meaning successful exploitation can impact systems beyond the vulnerable component itself — monitor for lateral movement or privilege escalation following initial compromise of the Management Console. ↗

• · Only Oracle Storage Cloud Software Appliance versions prior to 16.3.1.4.2 are affected. Patched installations running 16.3.1.4.2 or later are not vulnerable. ↗
• · The vulnerability resides specifically in the Management Console component. Detection and patching efforts should be scoped to that component. ↗
• · Oracle references internal document 2768897.1 for additional technical details, which may contain further operational context not publicly available. ↗

CVSS provenance

nvd v3.1 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_oracle 10.0 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.